{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4a8ae8e1-9c04-51a6-88c2-3218e986d395", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "websocket-api", "version": "9.4.48.v20220622-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:43b6fdc3-07c5-56af-9931-a1efa769e97f", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ae58427e-2064-5523-99d1-1dd21934319d", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f6656493-c71a-5f83-902f-2ce39ca6def1", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:db628f8b-67fd-521c-8238-da5ec63fa3c1", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2bb875dc-d6d6-5906-8e19-9b0fb1074de8", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4b36779c-d35e-51d8-b9b1-0c2bbb043fca", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:292d913d-d6cf-518e-8665-9f54b4c3d66e", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2e943a49-ff54-5611-a6b6-28d39af419c4", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cc02c4a6-8cc2-5484-a2a2-78250a393944", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d0ba9c42-708d-5340-985d-d00369b4e148", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:18ba4480-d186-5847-a6e2-01a0ac0085c9", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5c433446-1cb7-5570-a72d-aa0dc10db8b8", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:38cbae15-4d07-50d3-b592-e6d4491337cc", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3349c72b-c836-52c7-85db-f279781c4ff7", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:25c3f23b-8357-57f6-ba82-4ce64c27a9d6", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3bddb775-8b93-55d4-b16c-74aa41c3719d", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9875cb5e-55ee-5c1c-8ebb-b63f873b88ff", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:298c733e-9ecd-522d-b5a5-2191ae89e41f", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4e239ff0-b5c7-5553-b627-e3d38b5b46d3", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a5a6013f-dfba-5cae-a8ff-95bf825c76a9", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f9708de1-2d31-563f-9873-6c2fd06994b1", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f7b8de6b-9192-554f-bcee-4d73df14a6e6", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:50d7d2c1-a3db-5a0d-b4b8-eae54f312c48", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b94ce316-4626-57f7-a815-17b32856a975", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c996558f-d44e-50db-b1b0-f6fb0121bc3e", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:38c6873d-d77e-58d8-a571-cb6d749eebfa", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.4.48.v20220622-tuxcare.3" } ] }