{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ec3bd1e9-6a34-5859-b591-06287728f6df", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-http-spi", "version": "9.4.48.v20220622-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d05804b3-5667-522c-aff7-ab7ab576acea", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8b7a8fa6-e23d-59db-8a5a-aa34562dfb53", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:433565ef-b811-5417-88bf-50f2f59eef20", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5622f6c4-a5f8-5ee8-b884-7ee88ca3fe73", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a8f34270-3441-5d1d-ab19-3ebdc554aab0", "id": "CVE-2023-26049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b64fc6e2-29cc-5423-8420-d2fdb5482a2d", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:452795ce-9e9b-5c9f-94e1-314f4f49c52b", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:47545d90-89b6-5072-98dc-5a7c855e16e7", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0d74ccaf-205a-595f-b5d3-4eeffb446c71", "id": "CVE-2023-41900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:be2f4f9f-376e-5320-ad25-87528b936e40", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e33c216e-185f-5259-95f6-8041cdc1a774", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e51abf3e-9d1a-5d86-a729-7338bb6de243", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1ebc2ea-32e2-5c49-aef7-17201c36f0ec", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:df5bf46e-61e2-56e6-8c60-450ede50044a", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7095d1d7-8ccb-517f-a708-827d47376275", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8ec5119f-3e5c-5d0c-a009-5b36404ce755", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2c32683a-de3c-56f7-86f3-aedefe66d8c2", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:948147c7-eb43-5f76-952d-546de8cb6423", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e52ec57b-0d7a-552b-925d-5d5c8b304458", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9b4882ec-71ea-5275-9c70-b6169b75003f", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:afcc7648-b7d8-594f-ac09-218502a5c905", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:70df081a-baae-5c81-9f41-10160923a541", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:18a36093-475a-589d-b117-cd8305c22d48", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:29105b1c-e722-5fed-95e7-61bbaa877fa5", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9d8ce9e0-0c2c-5b46-be17-187ff87caa55", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:51f21466-5cee-571a-9260-8174c740bf90", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 9.4.48.v20220622-tuxcare.1 of org.eclipse.jetty:jetty-http-spi." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http-spi@9.4.48.v20220622-tuxcare.1" } ] }