{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:41b06359-72b6-5060-935b-01c3b5aef0e3", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.tests", "name": "test-sessions-parent", "version": "9.2.16.v20160414-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:efc7a784-968d-5e88-98f6-bcdf022f464e", "id": "CVE-2017-7656", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7656 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b9789ea6-2870-5451-adf4-bed64f0ad500", "id": "CVE-2017-7657", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7657 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e9279512-cced-5d61-b2f0-78e4673ce0cc", "id": "CVE-2017-7658", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7658 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2017-7658. The fix was applied through the CVE-2017-7656 backport (commit 41af32dd6bd) on 2025-12-10. The same upstream patch (a285deea) fixed CVE-2017-7656, CVE-2017-7657, and CVE-2017-7658 together, as they all address HTTP Request Smuggling vulnerabilities in the HTTP parser. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2e5073bb-6da5-54a6-8cbb-dcae1a7d19e9", "id": "CVE-2017-9735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-9735 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:699215d6-5109-5ecf-9c12-24beb2664382", "id": "CVE-2018-12536", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-12536 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e96dd246-f70f-5ab7-b6fe-40f6f777cebb", "id": "CVE-2018-12538", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:65bd5a53-b9d7-5dfb-bb3e-6030822df9bf", "id": "CVE-2018-12545", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:601f7f8b-7f4a-55be-9b66-8b4177d2fd73", "id": "CVE-2019-10241", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10241 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6c8dc248-38aa-5a81-b298-ac3af41b5ccf", "id": "CVE-2019-10246", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:34ef2d1d-9dd9-5b8c-8bde-b2a11ad3ffc0", "id": "CVE-2019-10247", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fecc2a69-4aa9-5051-ba0a-4e40141d182b", "id": "CVE-2019-17638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-17638 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:06bb303e-1582-5a35-a20c-ca90e238c633", "id": "CVE-2020-27216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-27216 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:90b297dc-9629-50ae-9fbf-12c60c66692d", "id": "CVE-2020-27218", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:14c3ea32-1aef-5b94-a847-75050433c196", "id": "CVE-2021-28165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28165 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6b1bc8dc-d87a-5fb5-84cc-3b3c60897394", "id": "CVE-2021-28169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28169 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:76dbd0fc-276f-5e19-a087-a43cc104be07", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:20ed3198-3861-5382-bf4d-965c8a5a9df1", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b8993c4c-a101-5a63-a6f1-c6dc6d4fc10b", "id": "CVE-2022-2048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9f1d2a7d-5d2b-56b5-b623-503fe3163c1a", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:82668767-2cda-5dc9-a934-7f09137caf51", "id": "CVE-2023-26049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:102300b2-3ab9-57b2-8350-699c3a130425", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5f99a005-6f98-5351-bf4a-c3c287b6f32c", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:784b0b18-a676-591c-921a-879a499fcce3", "id": "CVE-2023-44487", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44487 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee43f212-00d6-506d-b97f-35e2da45f3c3", "id": "CVE-2024-13009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:76001418-13f2-51e1-9509-42bfd8138bb4", "id": "CVE-2024-6762", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6762 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository (Jetty 9.2.16.v20160414) is NOT vulnerable to CVE-2024-6762. The vulnerable classes PushSessionCacheFilter and PushCacheFilter do not exist in this version as they were introduced in Jetty 9.3.0 and later versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4d38e5a4-a089-54ff-9dfe-8fb649cb1876", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5343bcc5-59ea-5e6b-962e-52524c584959", "id": "CVE-2024-8184", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository (Jetty 9.2.16.v20160414) is not vulnerable to CVE-2024-8184 because the vulnerable component ThreadLimitHandler.java does not exist in this version. ThreadLimitHandler was first introduced on 2016-09-08, approximately 5 months after the target repository's release date of 2016-04-14. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:41bef9ba-bd7a-50c9-ac2f-51b5d9148745", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6633f355-d8ab-564e-a37e-8d3e42ac0829", "id": "CVE-2025-11143", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-11143 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent. Jetty version 9.2.16.v20160414 is not affected to CVE-2025-11143 according to advisories." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:872c2322-8871-5af1-822b-cf75f68df6cb", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3a686161-95a4-579f-81a1-3ad514352231", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent. not_affected \u2014 Jetty 9.2.16.v20160414 does not implement HTTP trailer support. The CVE-2026-10051 vulnerability concerns trailer data leakage across keep-alive requests, but this version does not process trailers at all. The HttpParser has a TODO comment where trailer handling would be (line 1536), and no trailer-related fields, methods, or APIs exist in the server codebase." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:12dd5a43-675b-5398-b36c-eb7e16154643", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent. Version 9.2.16.v20160414 is not vulnerable. Summary: Target repository (Jetty 9.2.16.v20160414) is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.0.5, while the target is running version 9.2.16 from April 2016. Additionally, the target version does not support HTTP request decompression, which is required for the vulnerability to manifest. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d264bb15-43f7-56c2-b86b-eeadab892af5", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:077b5f3e-a75d-54ac-adf0-a8c8665a0254", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bc124a57-0230-56e4-b88a-b4b064b84911", "id": "CVE-2026-6790", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6790 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent. not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-6790 because it does not implement HTTP/2 or HTTP/3, which are the protocols subject to this vulnerability. The CVE concerns mismatched :authority pseudo-header and Host header validation in HTTP/2 and HTTP/3 request processing. Jetty 9.2.16 predates widespread HTTP/2 adoption and contains only SPDY support (which uses :host, not :authority). H..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:19ce61e3-76ed-5e49-957a-560e7385024d", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent. not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's URIUtil.canonicalPath() method which has a slash-tracking bug when processing semicolon path parameters. Jetty 9.2.16 has a fundamentally different architecture: its decodePath method strips everything after semicolons before normalization (URIUtil.java:289-297), preventing paths like /public;/....." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bad52921-773a-51e4-818b-c4ac45d674bf", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-parent@9.2.16.v20160414-tuxcare.1" } ] }