{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5ee9d757-0200-5bc0-a01e-f93d75a569ed", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-hazelcast", "version": "9.4.48.v20220622-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6ed7a4a8-b95d-5f7d-a24b-39f909cb46bb", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:95880371-8879-50ab-a81f-15da5bb0a41d", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:20c7e44e-461c-5a5f-ba15-4fc35721d3f7", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bb5afca4-9490-5ce6-bf2c-43725f25ae40", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5f8ef59c-c763-5c30-95db-4cb1d4889d1e", "id": "CVE-2023-26049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fd78284f-7cbd-55ad-b8ff-62df31765a3f", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9d26bc7b-37e5-5336-ad2b-072f2906cd74", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:21f19ffd-61f8-515e-8573-99c84ce40e16", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:98d00266-6f6b-5032-9036-cb5b2b197e69", "id": "CVE-2023-41900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4c9ab7ab-509c-5ccd-9527-60389ed8c35d", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:951e0218-48b0-5db7-a429-6dda9710b2ee", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:990be049-0736-5f80-8e89-f3d0cece3a62", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9bd61592-104c-51a8-ad41-efdb21d1c3cf", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:654304a6-0e3f-5c69-8549-ac8fa5071581", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d5e78100-d74f-5e36-9c06-cb2c2f73a006", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:570aafb9-9fa7-5ebe-bb37-0a1989195681", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2456ae61-611f-5a6c-b5e9-0200ac0b4039", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:56c46000-a3c4-5867-af99-8aa6839e2b47", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cb173ad9-6611-5225-bfca-9e49475743d5", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b05b71bb-24df-5320-ad5f-7cf6dd150be5", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8b07496e-05c3-5a66-b187-e34fe633275e", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e2f2de6c-bd24-5826-ad33-f0620d06d8ea", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c61c99ae-4f9f-5c3d-b1e2-4c4708b64b49", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6caeed4f-9f9e-5763-9045-80d20b50a71e", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:546f69f0-3975-5398-bf06-7d0a3368f48c", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d7585ee3-e5fb-565c-a843-3a15a1ba72ce", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-hazelcast." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-hazelcast@9.4.48.v20220622-tuxcare.1" } ] }