{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ad6dc298-3471-583b-ab84-685397f12c81", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-servlet", "version": "9.4.48.v20220622-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:87f2f165-e7e9-5f79-b584-ccddbecfdda8", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d7643ede-d631-57de-b2cd-5b59d1a6bbd8", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8c4557d4-cf9d-5354-adc9-9d07102b2a88", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c2350bc2-2a01-59dd-bd8e-d10b3562dbe5", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a0bbf083-15a7-5e5b-ba1d-2ea93c707ff5", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d64d47dc-bcf7-5ffb-a3f3-5f1ccbfa41a2", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6406ce57-352d-52d9-8ffb-8efff082b90a", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:02ac0f2e-b0bd-51ac-a336-b4c60153ceb8", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c34e6b63-eb3d-5393-8a6e-638455077a64", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5e40d87e-a54a-5c74-85de-f245115c304d", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:11ce0c5d-84cd-56df-adde-61196665eafe", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:38765b66-a0ad-582f-82c3-8a2c88363a44", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cde61236-377d-5dd4-983f-11f24eddd3d5", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e0db0414-7997-5c54-a0f3-7dbb67ea5cc2", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:76e0fec2-17d4-558d-921e-442efe35b21d", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3f02088e-8b1b-5e83-9e6f-8334499119cb", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:95cbbc4e-103d-5324-956d-2817a55f05eb", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c13c051b-f778-5985-b1ee-90dd2f92a29f", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c516beb3-f502-5766-8259-19d12e964cd5", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a98fcfa0-d7fe-581f-b02f-add774ea16b8", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:711b31b4-1e3a-56a0-a6a1-26930416fa62", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1449d57d-7684-5fb7-83f5-109f64da4084", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:22d4a775-3ba9-50b3-a9dd-54a3e34fbec4", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:24b51c24-c237-5ccc-8afa-1ad14fefc365", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0aabf5ea-6fd9-5801-841d-a839656c2f83", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:86676a5d-d57a-5da7-a366-1dac33cd18f4", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.48.v20220622-tuxcare.4" } ] }