Your bug report #47562: java-eclipse-jetty-* packages are vulnerable to CVE-2021-28165, CVE-2021-28164 and CVE-2021-28163 (also probably MANY others, 4y w/o upgrade) which was filed against the guix package, has been closed. The explanation is attached below, along with your original report. If you require more details, please reply to 47562@debbugs.gnu.org. -- 47562: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=47562 GNU Bug Tracking System Contact help-debbugs@gnu.org with problems