{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:123757cd-0951-5b28-827a-206745f57ca4", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.aggregate", "name": "jetty-server", "version": "7.6.0.v20120127-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:63aa7a80-6544-56ae-aa84-39b10ae46fed", "id": "CVE-2011-4461", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2caff5e0-4df2-5b0e-80ba-03a9f2674551", "id": "CVE-2015-2080", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:78674c4e-6bf0-53e1-9c0b-e102866a58fb", "id": "CVE-2017-7656", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7656 is fixed in version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:436565da-810f-51db-b99d-da01f35badfc", "id": "CVE-2017-7657", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7657 is fixed in version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:930664c8-325c-5274-8993-2384516efd46", "id": "CVE-2017-7658", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7658 is fixed in version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:67e6b66c-b85a-5764-beed-d52552484e19", "id": "CVE-2017-9735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-9735 is fixed in version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3340712f-c527-5700-8959-14dfec58e645", "id": "CVE-2018-12536", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b572aeda-e3cc-5ec8-afb5-c09b502c8971", "id": "CVE-2018-12538", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:eb76a15d-19a2-5bfb-8b9e-d04f1f27fd41", "id": "CVE-2018-12545", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ace3d386-3632-5cd3-baa5-cfacd20bba9b", "id": "CVE-2019-10241", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2130056a-c204-5a89-abab-1b274dd40799", "id": "CVE-2019-10246", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:433d9a14-8888-5823-8b1b-f67a9b22b09d", "id": "CVE-2019-10247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10247 is fixed in version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b46ecd54-14fd-573c-a437-8b3859f8820b", "id": "CVE-2019-17638", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4b8251a8-1b40-519e-b36e-248cd946eb35", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:51e586fa-c6b1-567f-8d59-74878f57ed8c", "id": "CVE-2020-27218", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a4469983-ead3-5a1e-8c3c-ca3612977df2", "id": "CVE-2021-28165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28165 is fixed in version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5978768b-1e7f-5d40-8b8b-b56a5436737c", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:81495276-1df3-5c30-a00f-696c3f84bb17", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server. Version 7.6.0.v20120127 is not vulnerable. Summary: The target repository (Jetty 7.6.0.v20120127) is NOT vulnerable to CVE-2021-34428. While the CVE affects versions <= 9.4.40, <= 10.0.2, <= 11.0.2, the vulnerability is specific to the code architecture introduced in Jetty 9.x onwards. Version 7.6.0 uses the older AbstractSessionManager architecture where invalidateAll() is called BEFORE sessionDestroyed() listeners, ensuring the session ID is properly invalidated even when l [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2d96009d-9cc4-564a-9d90-7914339b3dd6", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dd56a714-3146-59ae-aebc-f424aa3061d0", "id": "CVE-2022-2048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ec930dc5-0de5-5b5e-98b6-4015717cdea7", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dd08c083-fbd5-5cee-9ca4-7e4da98cada4", "id": "CVE-2023-26049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:535a111f-011f-5133-901f-25f01a451404", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:eff0387d-0c8c-51de-88c1-a07b168475f7", "id": "CVE-2023-40167", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-40167 does not affect version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server. Version 7.6.0.v20120127 is not vulnerable. Summary: The target repository (Jetty 7.6.0.v20120127) is NOT vulnerable to CVE-2023-40167. This version uses BufferUtil.toLong() which rejects '+' prefix in Content-Length values, while the CVE affects Jetty 9.4.x+ versions that use Long.parseLong() which accepts '+' prefix. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b97525a9-70ec-52ec-b563-2ad927d1628a", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:47d3c48f-086a-5f75-97b4-f804090544de", "id": "CVE-2024-13009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8afab13f-5e05-56c4-89bb-edf7b48e1516", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:79c1da48-e916-5e86-bf78-0bcea75ea708", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:47dc8e93-6c5c-59cb-99c1-db2e04b1a933", "id": "CVE-2024-8184", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server. Version 7.6.0.v20120127 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2024-8184. The ThreadLimitHandler class, which contains the vulnerability, does not exist in this version of Jetty (7.6.0.v20120127 from January 2012). ThreadLimitHandler was introduced in later versions of Jetty. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:796326b1-de76-5f88-88be-380864fab9fa", "id": "CVE-2025-11143", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-11143 does not affect version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server. Version 7.6.0.v20120127 is not vulnerable. Summary: Analysis cannot proceed: both patch content and CVE description are empty [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:333ea3cb-158b-5fbf-9b75-fd69ededee6b", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2adbf726-6c97-5e0c-a2e8-1ac0f2d561ec", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server. not_affected \u2014 Jetty 7.6.0.v20120127 does not implement HTTP trailer parsing. The CVE-2026-10051 vulnerability concerns a connection-scoped `_trailers` field that leaks between requests on keep-alive connections, but this version predates trailer support by 5 years. Trailer parsing was first added in Jetty 9.4.2 (January 2017); this version is from January 2012." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8dd9f6ab-b048-5ced-99ff-e877e729710c", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server. Version 7.6.0.v20120127 is not vulnerable. Summary: Target repository (Jetty 7.6.0.v20120127) is not vulnerable to CVE-2026-1605. The vulnerability requires HTTP request decompression functionality that does not exist in Jetty 7.x. The affected code paths (GzipRequest, GzipDecoderSource, InflaterPool) are only present in Jetty 12.x architecture. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6692a45d-6616-5c5a-8db3-48d57df276ff", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e1cf2c23-ebb2-501a-91e3-2e2e468fd7b1", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cab29480-f663-5eb1-b970-7e655b0378ff", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bcd507c7-c314-53be-9c79-658675a90da4", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server. not_affected \u2014 Jetty 7.6.0.v20120127 is not affected by CVE-2026-8384. The vulnerability describes a bug in Jetty 12.1.8's URIUtil.canonicalPath() method where semicolon path parameter handling fails to update the 'slash' variable, causing dot-dot segments to remain unnormalized. However, Jetty 7.6.0 uses a fundamentally different architecture: semicolon path parameters are stripped BEFORE path normalization ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:302fa874-d07f-513a-bb09-ae345236bf74", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 7.6.0.v20120127-tuxcare.2 of org.eclipse.jetty.aggregate:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-server@7.6.0.v20120127-tuxcare.2" } ] }