{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:99590bc9-24eb-5811-83ef-eb92e02e3adb", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-alpn-openjdk8-client", "version": "9.4.50.v20221201-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0c65fb19-7985-519b-8f02-084ffef8db51", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d24d62ac-809d-5cce-9cda-2cbe3b5219e1", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3953c1a3-a3cf-593b-9269-d181b3a57c32", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0e00c7ca-ff7c-5ecb-aef1-7759e4b65f03", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:108f688f-7c1c-5ca7-a8a3-164829d1e2df", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:97ea393e-1054-592d-a4e1-c6c91e4fff96", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:527ebe3a-9cca-5de9-8aaa-ea1cf0c2aca9", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d8abb9ef-b036-5aa8-aa86-5b7bfcbffecd", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e0a55906-d07d-5ed5-9c3b-1420bf06d1ce", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cd68678c-9b32-541f-be4f-a67e6693b570", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b921f283-6565-5ce3-a3e9-86c86ba03ee3", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9774a610-c746-5bbc-981c-54ffc005ee77", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1692646b-7bff-5041-aa76-aa96a154e0d2", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7a171f20-ecd3-5ae5-ac61-1193653399d3", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9cef927e-735e-5349-b1dd-0dabc3d18b66", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d8ffc0cf-5587-54d9-8fd1-13664f4fd311", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ac0c6c2c-c3fc-515b-91e3-1fb3d6a4e09b", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:98599735-3977-5c42-ae65-8200104dcff6", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:65b8488b-53bc-5f6c-ae64-7c4890fe6ce0", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9d723171-7bdc-5279-9f28-790b9d11e580", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e592f49f-0f6b-58df-b2b3-1b172de9561a", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cfc933d0-f250-54b5-b822-2f69b8aa6a33", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4534cfa0-5aeb-568d-a612-25a9ed629135", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:49769a14-9db9-568b-aef2-53f7dabef571", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:57974b0b-c283-50b2-aaa7-44f17ebc9b4f", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cad5dc6c-c7b9-5ce1-8741-4e677c52f023", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f9d15ead-0dde-56ed-a1cd-0e0ddb7b730c", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.2" } ] }