{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b6fc2a4b-9ca5-5e1b-b8a9-9e63098492aa", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-cdi", "version": "11.0.19-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:12ec6334-9eac-54d1-96ed-5cd36302c742", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5be0eadb-c75f-52db-b6ac-0ba8bfd73eef", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c7715a11-dfb0-561b-8bc2-0c1535d2b380", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d8d77ac7-946d-5f6d-ad2f-46536755a4b2", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b25e7964-a1de-5808-93d7-ef53de75e859", "id": "CVE-2024-7708", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dceeb627-99f1-5e71-a1fd-977c7bbb60c4", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6d0ad40b-c893-5e83-9b57-3c0e05f568a4", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e4c0cfe0-b83d-53ff-be63-80358c9a87fe", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d31791fe-6985-561c-83b1-34669404e687", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:97dd35f0-1cb4-5a2a-863b-eca82c342102", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-10051 (HTTP trailer cross-request leakage). The target version has a fundamentally different architecture from the vulnerable Jetty 12. In Jetty 11, the `_trailers` field is managed in `HttpChannelOverHttp.java` and is reliably reset to null in the `recycle()` method, which is called after each HTTP request completes. This architectural defense prevents..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:943d0aa9-224f-56ab-a06d-e7fe000d3461", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi. Version 11.0.19 is not vulnerable. Summary: Target repository is Jetty 11.0.19, which is not affected by CVE-2026-1605. This CVE specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.1.5). Jetty 11 uses a fundamentally different architecture where request decompression resource cleanup is properly tied to the request lifecycle via HttpInput.recycle(), not to response compression status. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:eea4413c-e5f1-53a6-a4c7-1f5cc111bee8", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:403a1216-0df3-5434-b375-08e5951e5dec", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:421d3117-9b67-5704-a29a-75b10d12e265", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e506d29d-26fc-5a89-8f07-b9389da62ab3", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.x due to architectural changes where canonicalPath() processes encoded paths directly with semicolon handling. Version 11.x uses a two-step process (decodePath then canonicalPath) that correctly normalizes paths like /public;/../admin/secret to /admin/secret, preventing security constraint bypass." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d2f6b2f9-7d2d-5121-bbfa-f5c64e466ac8", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-cdi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-cdi@11.0.19-tuxcare.1" } ] }