{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dc739d53-ac5c-5642-9ed2-5df8e0a12375", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-nosql", "version": "9.4.50.v20221201-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e292fa4d-2586-5461-885a-f10c0baec8d8", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f9bd2cef-dbd7-5df0-b080-bba4bfc6b8da", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9080c79f-6f75-526b-9650-a07f354f2c7a", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b4b466d9-dc5d-53f1-9f41-a78e9846ca08", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:140f0ba5-7c3b-5e44-9296-d8efed4dea8d", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:36936f86-28ea-5101-bfc3-e85c48787d31", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:05ac7a84-c717-53e8-b598-c899efbf45c4", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:148ac901-3966-55d4-a8cc-bdc68a239dc3", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dd1b8af5-6124-57de-9911-53501fc72ad2", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d4ca1fb2-83ed-594b-bb05-0b9e2fe25b78", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:81e5b0f9-b611-5f9c-b5bd-a7a214014c7a", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:28fffbbc-6c11-5b00-90af-00c68a55aa61", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:294c9957-227f-5312-bf1a-8ca34068b559", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:48493343-cb23-53a0-91f5-7d63308bceb9", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:185f903c-7fa7-5868-8d03-f68dd9d73001", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2b28324d-e9b6-5781-b71b-2e4fa28236db", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dec331ef-3527-5bcb-bb6c-c825e229c18f", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:689a6ced-c7a7-5512-a47b-294e3ed9a212", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2c0ffdb8-9105-5449-b341-c79ab2abc902", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:04eefacb-aa97-500e-bdf6-fa5cc213b669", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1ce51013-a541-576b-9130-2b96d78636a6", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4c205b2a-2078-5a78-bc12-34bdf863c422", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:07a28ad4-ab6c-5897-9818-de06da65a439", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1b968f96-dbeb-5e97-80f6-52631e6819f1", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:10127b6a-6b0f-5c51-a397-d747e61e2edf", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:59a6cf0f-9b1f-504a-88da-d482dcb1ca25", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:36d67db7-45eb-5abe-a1f1-ae83d0a89a7d", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.2" } ] }