{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3c7f2ba7-4b0a-51f4-a6fd-e98397d52843", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4", "type": "library", "group": "org.eclipse.jetty", "name": "infinispan-embedded-query", "version": "9.4.48.v20220622-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:eb03cae1-ce1a-5463-a0e6-30bee8c61db4", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7928f496-07dd-5354-8a5b-e66890aa68cc", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:057a5e9c-f918-52e8-977c-9c62f7a785fd", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1b321a44-39da-5bca-b22d-39df0f65fb7c", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0d50e0f7-556f-508f-a386-5191ef02ea42", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dc285413-a5a5-5ca2-b18d-5028505b5ed2", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:68b81878-96bf-54f2-8109-02892f30ad28", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:74dd7bdf-cf32-57d0-9feb-d51e6d7caa83", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e201a9c4-7218-5e79-9b54-ffbd21b58cc3", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d2d75483-f2b5-5aab-a223-6e79efddeff9", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:98792eb9-2cf8-5d43-9d0a-ee4dbc0e26e9", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:48a07929-76ec-56b2-b1f3-582dc8f8fb04", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a703c02c-de52-58aa-870f-d5fa2c5fdd51", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2403a9c7-f45a-5a73-a751-90965a4b69e3", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7bc79a9d-f204-571f-b7ae-e55f3e4e3b4c", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6f57f791-8835-5e58-9a49-074b3cdc4003", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:183f0a85-9090-5f63-a47e-3429b18400e5", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ca6ff642-6be6-5e07-a5bb-a0ca6e3c155a", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f82de4ee-483d-5a90-b62e-a04dfe4198df", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:48101323-143b-581a-9f5b-119ce20bab2b", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:03072be6-a5bb-5ffa-86ef-1c19ffa1d809", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3717f7c1-14a9-56d9-b442-a7bcbfca83e0", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:78a60eea-cecc-5ecb-9b4d-37b771816633", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f4649571-0a76-5903-b7fc-3d27c96b209f", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:10b4f817-90fd-54b1-af19-cd75a3dbda65", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:679dab1b-a1f0-573b-ab77-a00711bdb441", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:infinispan-embedded-query." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-embedded-query@9.4.48.v20220622-tuxcare.4" } ] }