{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0e4fcf43-cbc0-52d1-b7d8-bb3fa65bf126", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.demos", "name": "demo-container-initializer", "version": "11.0.19-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8812d3c1-b488-5fc0-931c-55958a211b00", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:82e862fd-7bfc-5c62-9be1-82f4f97f656d", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cc951d9b-e630-5347-9973-373cd2b465f8", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:665d9715-48ea-5fed-b7d6-e69766f2d3d7", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2abf95c7-74a7-546e-875f-b650c9ac6229", "id": "CVE-2024-7708", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:92ecdce9-b3f1-578a-abe3-d2254010ec21", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:eded2211-96d6-5258-bc22-5fabc2474c6d", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d31c146b-3bb7-5218-8374-d86605245134", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:da051d2f-6542-5b8b-ac25-762a1fd3c7b2", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:37e8a10e-3cbe-5136-81ff-c166f76edcc2", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-10051 (HTTP trailer cross-request leakage). The target version has a fundamentally different architecture from the vulnerable Jetty 12. In Jetty 11, the `_trailers` field is managed in `HttpChannelOverHttp.java` and is reliably reset to null in the `recycle()` method, which is called after each HTTP request completes. This architectural defense prevents..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:19baa160-ce6e-5e21-b8cd-c94731dbaf5c", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer. Version 11.0.19 is not vulnerable. Summary: Target repository is Jetty 11.0.19, which is not affected by CVE-2026-1605. This CVE specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.1.5). Jetty 11 uses a fundamentally different architecture where request decompression resource cleanup is properly tied to the request lifecycle via HttpInput.recycle(), not to response compression status. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:302ba992-41b7-5792-819a-8559c0c4b49c", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aec968ed-076a-5b13-b6d5-8ba5ed82483c", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6559ac38-d726-5a42-a08f-dbc053c738f7", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:940d4614-c2cb-54a8-ada0-208d33b7462b", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.x due to architectural changes where canonicalPath() processes encoded paths directly with semicolon handling. Version 11.x uses a two-step process (decodePath then canonicalPath) that correctly normalizes paths like /public;/../admin/secret to /admin/secret, preventing security constraint bypass." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:41f4fdf5-249d-50b9-a12b-b705cd7ea6d5", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.19-tuxcare.2 of org.eclipse.jetty.demos:demo-container-initializer." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.demos/demo-container-initializer@11.0.19-tuxcare.2" } ] }