{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aa384ff9-5653-5ddf-8aeb-af5088504a0f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.fcgi", "name": "fcgi-parent", "version": "9.4.48.v20220622-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0436ad6d-8a8e-5bcd-b899-bedd404809f1", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:80469df4-511b-5f9c-8b93-7cbca4e653c8", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:64846fe9-8704-53a0-84fc-d6bd1ac1b853", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:de4d065c-3b82-52c6-ab0c-c673cec5eb06", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:69c14004-53d4-58d5-b5d8-3361b1aade84", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:26921647-1269-5901-a7a1-03affaa19cf5", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7d8c7329-39ac-5f24-adb8-a9fdacce8fcd", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8e79be84-20e2-5d2c-889e-49d2d6f5aba2", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2667397e-6230-50f5-b6a4-bcf8aa1bfdc3", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c36a318a-fafe-5260-975d-72f0f5f2bfa9", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a6335c5d-2cff-5e2c-af11-df0e6923814b", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:14c64af5-dbb8-512d-bb8e-75d2bbcb7543", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:199be4e4-bd28-5dcc-a9fe-b86b98e26015", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4234c867-d00d-58ef-adfb-254cd431203e", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:40b8c38f-3c8d-5db3-a44d-0dd372184d0e", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a55408cb-b39c-5efb-a5cd-d55895475606", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:58fa7366-c8a1-5f15-99aa-ee662df3b3d8", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:32fe3deb-e275-5c86-9a40-666872e697d6", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f8d0cad7-8b3a-56bf-94de-90936becf862", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a785c700-ab21-5c37-b0d8-bf25181fe013", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8e62a311-0726-5c31-950e-15f9f7925396", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ee113e99-f89b-589a-8223-a320264e5cd7", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8b7448d2-cf82-53ca-98c9-5eabc4e98987", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cf5850d2-7a7f-53da-a968-463d7e9c679a", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:24f67282-2a5a-5b05-b38b-d11e32c30228", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aa93f96b-e5db-5017-aa06-c63766443a11", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.48.v20220622-tuxcare.2" } ] }