{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9bd86cd4-e7bc-50ab-9ee4-49a2b2bab59c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-proxy", "version": "9.4.48.v20220622-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:bb68ace0-3ae0-5198-98b4-bcbeac2ede2d", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e82c59ff-24f3-54dc-afca-54ee5bdc6494", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:aefee4d5-aa50-57f0-9328-9ac116f83049", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b66b416e-d891-59d7-8a3b-d866bd8dab12", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5fc8347c-f35a-560c-9a9b-eb9e1327778f", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4e93af73-f271-517a-bd2d-6ea3ab178361", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e040512a-5921-52d8-b9a5-f6cda572263a", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cde3e9eb-1cda-53e4-b3be-3bba7c3a098f", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:40d546fc-bc2e-5258-82e4-030b66e133a5", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:db615fbb-e598-5e1c-a71d-a71e5ec04795", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6c7984b7-e6bc-5870-8440-39f9e0bb07fb", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3fea2c87-d533-5821-8ff6-fc023c76b2e6", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d04118a5-4d66-5bf6-a75c-560b44b1768e", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c04861a3-5d53-5865-9336-0b844be44de9", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:90009266-bb03-5606-964c-a13bf69a6196", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:51ab5e87-7157-5465-829a-36a33f58225e", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6254c0a2-02cc-582a-aeac-ac2eea20ae20", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e30c39da-1b43-5524-8c53-e20833d74be1", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:39bf9f04-804d-5194-9570-b2762e200671", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:42688204-06df-5d37-ac5e-43846dddb3b3", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:24a4d33e-ca94-5e02-8070-f1b35dc44159", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8fcd0ba1-6472-55af-861f-547dccc53d3c", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fd8df215-b360-525a-a714-59f7973fd62c", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dbfce7f3-4a80-54fd-ae06-8506895a5263", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2431bd2a-62d8-5cff-9632-3e008f095c72", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:964da4e8-c3da-5e90-8089-d6d7254f18b5", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-proxy." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-proxy@9.4.48.v20220622-tuxcare.4" } ] }