{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e10a9ba0-521c-5ac4-8a1f-dc204e4b89fc", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1", "type": "library", "group": "org.eclipse.jetty", "name": "infinispan-remote", "version": "9.4.48.v20220622-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c09c10b7-8f34-5173-a398-5ce8ed6288f2", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b53a3d36-5438-540f-b4f1-5a341884ce8e", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d31a8e77-a4d7-5141-adc2-8dd1d98fee4d", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2d2d716b-2505-5a5f-99ce-10ddae6eaf1b", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cfc8e3b4-967f-5e65-98a4-0fda779d2971", "id": "CVE-2023-26049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1fc51bdb-345f-5d98-a039-9d2b4cedb261", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:99fdfdc6-30dc-57d4-8ec3-9f2e58291af4", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:79a9cb2c-b2b9-5adc-98a0-b7460b220310", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e4b86426-4e66-58f4-8b07-6d42aa8292c5", "id": "CVE-2023-41900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:959cf20f-1d93-5e10-a97b-00d84add1493", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b846e636-fda3-5a0b-8d14-a59c14390498", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f48053d2-d380-5923-834f-48dd7b784516", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1c0b9b3a-9905-59b2-b23f-40b04b4343c9", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f383a420-1781-55e1-93db-a08e75f2da4c", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:46f21a52-5334-56d3-9188-f92aa9edd015", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ab99f04a-9627-55f9-b204-5e80447d730b", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d6cfef49-a8fc-593a-82c0-f1417b1c54f1", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:04be3a18-2b16-5d6c-83ff-5fa9a6857838", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:20092dd2-1e99-5259-b766-e1ed0bc8d5b0", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3f966642-3ca6-51b2-a2e9-b8bd8b326748", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2719f456-ce99-546f-aa05-3c0f970ecaad", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2df23953-13e6-5947-86cc-c3c3e193cc82", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4f5a3909-c3a8-51b2-8690-4ad9bfbf579d", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:db5f9217-dd49-5696-9c81-0024bd9331ff", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0d47c44c-8b5c-5a11-b223-13f85540f3f3", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:068abc9d-3d33-5c59-8239-8da97168f468", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.48.v20220622-tuxcare.1" } ] }