{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:321e332c-8976-55c3-a6f6-65394e45c4cd", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-proxy", "version": "11.0.26-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e7d8de51-2c10-5991-8135-90d8c5cef052", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e1813cca-43a2-5d22-85ca-7b24580e3ba7", "id": "CVE-2024-22201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:425b343c-abb9-56e7-8ce8-02bb86a10468", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8310d631-7d47-5023-a720-e79199be5684", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1163ddbb-f258-5db4-a67e-ad9519be0976", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:df6ef7e5-9ccb-5882-b299-2d285226e382", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c088be38-a0c5-588b-bc0b-708a9bf60c0b", "id": "CVE-2025-5115", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy. Version 11.0.26 is not vulnerable. Summary: CVE-2025-5115 (MadeYouReset) vulnerability patterns exist in the codebase (HTTP/2 WINDOW_UPDATE with delta==0, window overflow, and DATA frames on half-closed streams all trigger RST_STREAM from server), BUT the mitigation has been applied via commit a05e1d031d0 which implements rate control on server-sent RST_STREAM frames (default 128/second limit), preventing the DoS attack. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7cf4079d-2414-5655-a637-89415ce35a76", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e9c76ce7-e8be-5370-9ae3-e76dbe83230a", "id": "CVE-2026-10051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fe26713a-cc5a-5991-ba4e-b534e607d343", "id": "CVE-2026-1605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:acace114-6059-5d5a-a82d-981f8adb5107", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:667d887d-fe01-5f6f-a217-1be017636282", "id": "CVE-2026-5795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0337ba0f-aaa9-54ec-91ea-6ce9904556e9", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6f7877d8-bb5c-5e46-b524-ed66745d0b42", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy. not_affected \u2014 Jetty 11.0.26 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12 where URIUtil.canonicalPath() integrates semicolon path parameter handling with dot-segment normalization and contains a slash state tracking bug. Jetty 11 uses a different architecture with separate decodePath() and canonicalPath() methods that correctly normalize paths containing semicolons." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:22575aed-9e13-5c62-adc8-1110a8c6df74", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@11.0.26-tuxcare.2" } ] }