{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fef2b870-3f19-5007-a054-0bf78ab0e51e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-openid", "version": "9.4.48.v20220622-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:139d0b91-cdcd-59dd-968e-550e731b8dd2", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a395fc86-5b49-58f1-8032-dec70f6857b6", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b9e188f8-1505-597f-9479-f17253c5f4a4", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:81f13f44-a4bb-5c8b-a123-a80d83cd406b", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fe8b099b-2483-5ec9-97e9-20f9ee3c3db9", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5f80afff-ba6d-5a7c-9d7e-437287d69b88", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cba8153e-c96f-558d-bb77-a145d05f958c", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:527b53c5-b65e-5a40-9b26-78f40503adb0", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7ca5c7f5-28fa-52de-91fa-7d440ba64afd", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ef9bcd6d-93c5-5798-b72c-79a68e1c3e41", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5171fbe8-7dbc-5112-8955-1b44b82d8a4f", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fe99bc53-0fa6-578d-83ba-560030644450", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fcdefb3b-73d0-5d43-a776-2ec64987e2dc", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:93f091fd-f8d4-500b-92da-5035d5999fb3", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:efb0821d-6e36-50a3-987c-58e7b66ac28b", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:28cf91cb-46a4-5806-aee0-bf4af41d7f61", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:969e6df6-d988-5d4e-b2d7-56b0d9cb497d", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:edddb662-3efd-5956-b041-ea17b8bef719", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:97f69d07-aae6-52f5-b66f-015d05529fd4", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e53b26d5-84db-51b1-9842-120df05bb269", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8f924f32-d033-574f-a075-d778c626eac4", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e74f983b-0359-5482-89e4-aa2f450f201b", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1aca10ed-4637-57ed-89d9-e5f59be91ba9", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:575d0f7d-d755-5f20-b29c-cb2faae0f6aa", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c36b95e1-f3b1-5c4d-bc3d-15b8501fd177", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:585fb5fb-d4bf-58e6-8094-746631647415", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.48.v20220622-tuxcare.4" } ] }