{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:72b75455-79df-5978-9115-d7e2718a3491", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-server", "version": "11.0.19-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7e90a003-3ddd-5f5b-92d6-70e92c71816a", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9ebaaa11-70d6-5684-8393-51b0c2d3e264", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:babc4bf2-6371-5d97-8316-c792dd333934", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ec46be39-922d-5da4-bf83-e0279f0c130d", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:eb17f7ef-b4a6-598f-b555-e8cbff2d079e", "id": "CVE-2024-7708", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:860d5299-df9a-5996-babd-2a85f207a394", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:352ca3ed-34dc-53e4-8e4b-1e1858e19520", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:01493833-a596-5494-8a5a-ba2bd13c0351", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:49da42cf-b666-5a92-b8cc-ce1e53a1024d", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5696508a-3c70-58fb-a01f-81eebb04b3f3", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-10051 (HTTP trailer cross-request leakage). The target version has a fundamentally different architecture from the vulnerable Jetty 12. In Jetty 11, the `_trailers` field is managed in `HttpChannelOverHttp.java` and is reliably reset to null in the `recycle()` method, which is called after each HTTP request completes. This architectural defense prevents..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e542b4b7-4122-5114-911b-940ca3636ef6", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server. Version 11.0.19 is not vulnerable. Summary: Target repository is Jetty 11.0.19, which is not affected by CVE-2026-1605. This CVE specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.1.5). Jetty 11 uses a fundamentally different architecture where request decompression resource cleanup is properly tied to the request lifecycle via HttpInput.recycle(), not to response compression status. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ca28c303-7d97-5e4a-8556-411162c76c93", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7cb298ca-e3b5-5e64-be82-2817a9220e05", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:14e014f0-b884-5012-bf17-2877440f76bb", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:92e84eb5-f284-571d-84c6-dba0c23f9432", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.x due to architectural changes where canonicalPath() processes encoded paths directly with semicolon handling. Version 11.x uses a two-step process (decodePath then canonicalPath) that correctly normalizes paths like /public;/../admin/secret to /admin/secret, preventing security constraint bypass." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0aabd84c-e0ef-5d0e-ab91-c3cba9e945f3", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.19-tuxcare.1 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.1" } ] }