{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bf584c6d-2a2a-53e8-b9fe-32eea9c1b5e2", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "websocket-client", "version": "9.4.48.v20220622-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:fe6c6631-83c0-5c8b-9f31-6d3e74fc8685", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2f84ef05-5c82-503c-bda6-ff3c0dbd1ebb", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f45a1277-9ae3-57ed-a599-fa29918d9204", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e8cfc90c-c419-506b-aa66-1748332f5042", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cd3ef2cf-d53c-5f31-8320-19e90b9e5419", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4149e563-9404-5f69-acd6-4108b001f184", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a2bf3648-23d2-5518-bb62-372b177434da", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:32267a23-5245-5649-8b1f-a4c50f7c81f3", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:164ad973-ca9f-5946-bd16-ababd37b5074", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2b4c03eb-8253-56f4-945d-7d3e83dc2469", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0241ab2b-7b52-5aa8-8ad5-ce501c74b1d1", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b7d7bd5e-ec13-5489-9b9f-754ad4048d6a", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:31a24184-aff5-55bb-a126-ef95feffc1f8", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f0966e18-e56b-5d1a-93ec-c29e51dadcbe", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:18278d8b-604f-5024-9d0c-13bbc624f7c0", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:33cd44e8-b96e-5df1-9e75-1824378430f3", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d70a5b77-8266-502b-8c04-f73bc5f0c1e3", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b4b0fabe-babd-51a5-8c9c-d60a9047828b", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:42cdb5f1-9c95-56b8-b85b-8aaff8a7150f", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:737b6c0d-5d68-51b0-bfa8-5de4e2340bf7", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3cd38310-b0c3-520b-9977-403c682d5ef3", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:edd10cb9-bc83-548f-bc46-7fd012aa4807", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:605efb35-9d48-50f9-b1b7-f397ae204848", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:51768031-8c94-5886-adb4-ba54b11edc58", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:45ce0bbf-b943-5823-85ca-00a5cdcc2b3f", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:90bd5b95-e0c1-58b3-8c41-a38eb8733dad", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.websocket:websocket-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.4.48.v20220622-tuxcare.2" } ] }