{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:73418542-d8e3-50b2-b633-c1753be0d43c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-runner", "version": "9.4.50.v20221201-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:cd67a08c-9070-5638-b1e4-7623873dd919", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2052c195-c38e-574f-a368-4bfd3423aa35", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:70f1c3b6-e5f7-5100-92cf-bc4ea5b02bb8", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0a36f023-2184-5989-b40a-60f8f0fee62f", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:35354b20-3b44-5704-be65-85f3511ac42d", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cf21c76f-e0dd-5737-ba29-a257696d011b", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4346e05c-8486-5954-bcf1-f928dfc4000c", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b2b7a7ce-de83-5155-9723-fc52e00eadbc", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:570eed6a-ad19-55e3-bf0b-470cc152d2a9", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8530dee7-957b-5c09-804f-fead828f1117", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b36e9fc2-233c-5a3f-af88-07877c08193a", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:16bf5f47-810f-5b4f-a2f2-ff85d49de224", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cb4a1caf-bac0-57ae-8807-e10af3f5a46a", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:229c11f2-a4d0-5013-aed5-bfe22f1ee4ea", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8ae926fd-9083-5b08-ac15-6f0465c7f450", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8bbed288-8396-5bc1-9adc-e8063a1a816b", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a6ce1f9a-d180-52ff-bf56-452da422d21f", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0f2b7e94-b844-5685-b9b7-d35cb0c27e7e", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3752f458-7f22-58c2-98bf-258aeaa7de7e", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4721ca71-1335-5839-b785-99f2d15319c9", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6debf201-0816-589a-a49a-6819a1a97f60", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:28180c16-af36-5b1e-9f22-415fe497a1c4", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8d71ab9a-fd22-569f-9d64-12d2a76a888f", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:43fea2d0-1140-5666-afd5-ccd6db21735f", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:19c63f58-9bae-5b9a-9165-c36f87233420", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:71a88d80-98ca-550e-afbb-1970acd19932", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b4cc4e21-3ee1-5be3-91c7-b1b8af821903", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty:jetty-runner." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.50.v20221201-tuxcare.2" } ] }