{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5bf9f0fe-ee66-5278-bb73-62801d7bd5a3", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-alpn-openjdk8-client", "version": "9.4.50.v20221201-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0eb312ad-12f5-5b0a-9a54-dba8d6b3b47b", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:eddea6f1-1e04-5a2d-917c-632d2c243744", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c1195af7-836f-5cf1-a80b-ddd23585a8e8", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:02c9a9b5-b7e0-5ad0-ab9e-4ed250480a6b", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8191836d-dd48-5249-ae66-06c7da1ed25c", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c567472e-e412-5a14-bda8-5ad822aadf89", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a94fe4ff-758f-5510-baaf-d4af87b6fa7f", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6cb0f235-fe3b-553b-8ed8-49877759c931", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3cd1471a-e186-5eea-9e69-f4be60d18b4f", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3fb2ee20-dd42-5840-86d4-5caf66dd7ff5", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d99e3221-a34f-57a8-b93d-727c306cced0", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9b652fae-e6e8-59a8-bfbd-72dd80cd370d", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0f0fb98f-e7f5-5e3e-b912-19dcf4443345", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5e174d23-2cbe-565c-b825-e18f55951a8e", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:34063d5b-3598-5b5b-8c6d-062c90d6cc8d", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:88c96eaf-e010-5cde-90a9-a43c919f70c8", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:43fd7459-7ece-5d99-a363-5c9aa8f0633b", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:10ba302b-32f4-5429-993a-f7589e257bd9", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3017d77f-b394-58cf-bc30-0589c1b7a381", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:727a573f-dee5-582a-b4e2-6f57a6729020", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5761e712-caff-527d-b8a3-4b19834f6b23", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:50e3d2ef-cda8-5e40-a01f-204ee59dfade", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8b293edb-c4e4-59b2-b02e-7d815e1fd255", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9f5f83d9-6a90-5710-939b-3c3b75b2135a", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:90725481-a874-5fe9-a69f-11f2d6440aa9", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f99a9c4d-852b-5135-8fb5-22c4c5341574", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:79284508-271b-5117-9962-0aa2fc9873e5", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.1" } ] }