{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5674f4df-98d7-54aa-9142-5573fb77ab26", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.osgi", "name": "jetty-osgi-boot", "version": "9.4.50.v20221201-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:94587fb5-57d0-5a3e-9fd8-2a1a23d9dcb8", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:36bbaa2c-c50e-5dbf-acb7-0b821239e428", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:29b01052-b8ac-5b40-b63c-a37efb95ed05", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ac3a7b49-b9fc-51e3-9ed4-f133550c97d1", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9b79e66d-9e7a-5d6e-8b85-c94d7655be31", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8dbab566-2703-5ec1-b852-97037d2259a6", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3e328648-01e9-58bc-abd2-00b69ef948a3", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f916eba6-fb84-5ef1-bdd3-d62f3c674f55", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:049a8518-15ec-5a66-9226-953236d7f6bd", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:69aeb7d8-1082-5009-8906-61f4c4243840", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e46541bf-5e48-5a0e-a1e7-400960ee87de", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3bd78aac-e5be-5176-bb8d-fb9d29e6ae37", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1bab245a-5d0e-508e-b990-ad0c5922d790", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7537d83e-7871-526d-ad02-7fab765fb3ad", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4a5d58db-7bdd-5bbe-a5d4-95395afa7e3f", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4a1b56eb-d5d6-500c-891e-23641cc77808", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2fcad3a5-f206-533d-acae-ca1d2fe953c2", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3c2e5062-8f2c-5b63-97e2-c848f2fcd672", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:45579d0a-d9e9-5f5b-b0da-c9e4e7943ed7", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c3a25a0c-b659-5c44-84bc-574ff79954b9", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ca53d688-e8ae-5ecd-839b-c81599f0f1b0", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7b1bd750-3896-54eb-bd74-92a8861f036b", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d86d5c94-bd34-50dc-8740-66b54ccae688", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:94bb91b8-cb67-5fd5-8ae6-0dcb12bd12e2", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2d72238f-33ff-5ba6-b55d-1e1859fb71c3", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7f52fbd9-7f67-5378-ab9e-efd4a5629efb", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b27e1aaa-cc3f-5e5b-ad1e-b93f9c83d868", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-boot." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@9.4.50.v20221201-tuxcare.2" } ] }