{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7e3ef785-4836-58d4-9df3-09652094f100", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4", "type": "library", "group": "org.eclipse.jetty.http2", "name": "http2-client", "version": "9.4.48.v20220622-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f352a8bf-a28a-595d-aff2-68dd45e9e14f", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9fcae2f2-5a1b-5325-a741-4e1c79c3bfb0", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4746df61-31d0-5af1-a199-025f394cd2be", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1ff57611-269f-58c9-b2f0-baa1849f13da", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f6a8bd68-71ab-59da-b1d7-22574cb967fb", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:29b413af-ccad-567e-81b4-ccf6091669c2", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:14fc7be6-f78d-5616-9463-71ad22ca0a11", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c8daafa9-cd46-5c12-85c5-47e5fb2b31ab", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c9d0ba34-4dee-5c43-97e3-517e5c84f881", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:329da152-4e12-5317-902a-a49ff4ffc9e7", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:73f4e149-453a-53c1-8d7c-c2da02e2b07f", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0aac2dfb-0406-59ff-8f3f-bee7b1c076a8", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7230195a-9855-5b71-a698-5dc0708030a6", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:79d2018a-2644-5b77-9f36-e33c79f6810c", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0fb8ff25-bb29-5837-90eb-5c86f82f4355", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:046c1c16-49a5-5197-931c-779ca85f404d", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:723afb3d-1898-5637-a3c0-28aa6a371931", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7c0cbdce-b7c0-56a3-b9ae-27fb0842d229", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2bd9f18d-b85f-5b8d-bfaf-17677069b132", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2919465c-aa54-5771-97db-4369edf3e43f", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:99283c68-7f32-50db-a06a-bde1b86b4aa6", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ea5fb8b1-9ccf-56bb-8cb0-40f72819ae1a", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:284362c6-05ca-5dc6-bcea-e0e463d7e8be", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2ca2677f-71b3-5a8d-b9e3-caf9df00b0f2", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8eb276ae-4e4d-5d3e-82df-690650b2a5fa", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:af91a10b-7f97-5e3b-9794-f6b06e6891f7", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty.http2:http2-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.http2/http2-client@9.4.48.v20220622-tuxcare.4" } ] }