{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:50ab5705-2e9a-53f5-a4c7-4b70f41fce6b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "websocket-parent", "version": "9.2.16.v20160414-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0c3d178a-d3eb-5983-b17e-033714dc9715", "id": "CVE-2017-7656", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7656 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5e0a6e1b-cc93-5e23-ba2e-78905223e82a", "id": "CVE-2017-7657", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7657 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5eeb2265-d2ed-5fe4-9b5a-3429257a2462", "id": "CVE-2017-7658", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7658 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2017-7658. The fix was applied through the CVE-2017-7656 backport (commit 41af32dd6bd) on 2025-12-10. The same upstream patch (a285deea) fixed CVE-2017-7656, CVE-2017-7657, and CVE-2017-7658 together, as they all address HTTP Request Smuggling vulnerabilities in the HTTP parser. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c152f5b9-994d-5d39-9ec1-a553a20dfe80", "id": "CVE-2017-9735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-9735 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7611fb39-a9c9-5603-8178-9b02e8bbc918", "id": "CVE-2018-12536", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-12536 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5754934b-211e-5932-a606-9eb4fde23f76", "id": "CVE-2018-12538", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b44e9dbb-86e5-53e9-9a2f-58d381d40e99", "id": "CVE-2018-12545", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b6752745-e238-51f9-9b66-a14f71056a92", "id": "CVE-2019-10241", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10241 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:46f64025-1645-5510-99a6-bde47aff5b3d", "id": "CVE-2019-10246", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:98321b93-5af7-5416-9e3c-db6cfac26e3f", "id": "CVE-2019-10247", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:521c76eb-8532-5675-b1b6-99eceb240995", "id": "CVE-2019-17638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-17638 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c0cc7294-689d-59a9-95e0-d20ab0f3666d", "id": "CVE-2020-27216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-27216 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d4d8d2eb-8ab6-5838-b421-982f2514e865", "id": "CVE-2020-27218", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c4d2889a-cf39-5683-b82b-d69f2beada42", "id": "CVE-2021-28165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28165 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a0afe7dc-c273-5e71-b360-e0eb0209ba35", "id": "CVE-2021-28169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28169 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3576ee48-dbdd-59c2-94b5-244c1d0a4d77", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5026ad2a-c741-5a03-89f3-1c37fa038dfa", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f8e33f03-bb8d-5430-b4cf-532800c9ded8", "id": "CVE-2022-2048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:746faf8c-3056-52bd-ae18-c73949f40b1b", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:68111987-9dfa-5375-95af-1e6a921cfb1d", "id": "CVE-2023-26049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:59353e2e-3de4-5b87-96cb-55b65bc8168d", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4b00ca28-7b19-5869-922e-2cd7556f53b8", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2f357337-8f3b-5e7d-a2f4-40fd2e2878f0", "id": "CVE-2023-44487", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44487 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee719d08-8260-5068-8eeb-ab40637ad23b", "id": "CVE-2024-13009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:32361227-1d72-5729-9e4d-60eb14db87c4", "id": "CVE-2024-6762", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6762 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository (Jetty 9.2.16.v20160414) is NOT vulnerable to CVE-2024-6762. The vulnerable classes PushSessionCacheFilter and PushCacheFilter do not exist in this version as they were introduced in Jetty 9.3.0 and later versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6d43e8ee-6b7d-5131-b445-c6e10bdd5545", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9a215b81-21be-59d0-9270-71f3ff3b6971", "id": "CVE-2024-8184", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository (Jetty 9.2.16.v20160414) is not vulnerable to CVE-2024-8184 because the vulnerable component ThreadLimitHandler.java does not exist in this version. ThreadLimitHandler was first introduced on 2016-09-08, approximately 5 months after the target repository's release date of 2016-04-14. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:84e2caf8-80b5-5aae-8f90-aaadd25f992d", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:be04b9ff-649a-5c18-86c8-2a635188b07d", "id": "CVE-2025-11143", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-11143 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent. Jetty version 9.2.16.v20160414 is not affected to CVE-2025-11143 according to advisories." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8ed41d30-ac50-5b41-a7c1-6b60da9dd52e", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e6f286dc-1f55-50ea-a400-c0df2beb21f1", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent. not_affected \u2014 Jetty 9.2.16.v20160414 does not implement HTTP trailer support. The CVE-2026-10051 vulnerability concerns trailer data leakage across keep-alive requests, but this version does not process trailers at all. The HttpParser has a TODO comment where trailer handling would be (line 1536), and no trailer-related fields, methods, or APIs exist in the server codebase." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:549b9bc0-0672-5104-b7dd-4d64584090f0", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent. Version 9.2.16.v20160414 is not vulnerable. Summary: Target repository (Jetty 9.2.16.v20160414) is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.0.5, while the target is running version 9.2.16 from April 2016. Additionally, the target version does not support HTTP request decompression, which is required for the vulnerability to manifest. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fec99581-1db9-5526-a49f-ef20adb22deb", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2fbe211d-048c-5c35-8a7d-af777234d2c8", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1383c3d9-d6d6-5339-bb3b-3baf9d8c7dfc", "id": "CVE-2026-6790", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6790 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent. not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-6790 because it does not implement HTTP/2 or HTTP/3, which are the protocols subject to this vulnerability. The CVE concerns mismatched :authority pseudo-header and Host header validation in HTTP/2 and HTTP/3 request processing. Jetty 9.2.16 predates widespread HTTP/2 adoption and contains only SPDY support (which uses :host, not :authority). H..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8b05dbc3-1996-5533-b9a4-db2b83226698", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent. not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's URIUtil.canonicalPath() method which has a slash-tracking bug when processing semicolon path parameters. Jetty 9.2.16 has a fundamentally different architecture: its decodePath method strips everything after semicolons before normalization (URIUtil.java:289-297), preventing paths like /public;/....." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8270269f-07ef-573b-b768-2859633be209", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-parent@9.2.16.v20160414-tuxcare.1" } ] }