{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a4f298ae-0f65-5a99-8c53-fd3d777fb5b9", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.fcgi", "name": "fcgi-parent", "version": "9.4.50.v20221201-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:83d63503-7ab4-5305-bf3e-543e48ed4960", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2e373662-e942-5ad8-b7e4-dff77edb3334", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d65bd9c1-2fcc-528c-9586-4c6c15a2a852", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1526e5e8-8de7-54d5-a084-e290e96a4794", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ece0847d-3542-5c8a-9e2c-5aca8d188382", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c2113598-c55a-5701-960b-671612896d69", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:46daba01-d7e2-56dd-80c2-68939216e292", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9ec0300b-35a1-550d-9fd7-ec032801ba26", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fc18f3d5-04e4-5838-85c1-498a4242e40e", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a6c96ba5-2a37-536f-bc5f-213e6e58cf7e", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:70de7c84-dca3-5989-859f-b6e1f8fb213d", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b0ba78e3-3927-57d7-9d62-b0527e49fd9f", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:425ffa1a-261e-58a7-b600-ce00e249b1e0", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:935f9169-96aa-5ffd-a7d8-f2b18ed6146b", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:82a14522-839d-5e46-806b-7f2a5cd63cdb", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5ce83210-fb01-50b2-b57e-5864663de5a0", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a1929a1e-57f6-5e36-a083-6db286f3c22f", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:21d199f7-fdf8-53c3-b6fd-4e8567d4d257", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:06e737b1-4455-5077-963d-215ee61d73b3", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:832ed033-d586-532c-af4f-054b089203c8", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:10be9f29-f88d-5a7b-99e2-0f83354e0c05", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a8172c5f-6cce-5c28-960b-86b417739d73", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:417b902b-0fec-5085-9c3c-34d746409e07", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:81a130fe-6fe8-5b99-83e7-e112538e1c03", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b5d54616-4a12-53f0-a9f5-87dcdbd72321", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:20f0fb89-6880-51d7-890d-b7b137b09365", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bcac8801-6479-5c11-9548-09ed624d7c4e", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-parent@9.4.50.v20221201-tuxcare.2" } ] }