{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fee55885-05fe-5edd-ba07-6841ddde24ad", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-servlets", "version": "9.4.53.v20231009-tuxcare.6", "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e8b30842-e491-5a21-8f8f-7f3937f441db", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:eacc525f-70c4-59a9-a1fb-a2d76427306b", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9d82c7da-6819-5276-b2c9-73ebf6114b41", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4aafb373-add7-5146-a8ac-a47362497c13", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:82cdcbee-610a-5468-8d51-ffddfb938fc2", "id": "CVE-2023-36478", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36478 does not affect version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets. Version 9.4.53.v20231009 is not vulnerable. Summary: Target repository is at version 9.4.53.v20231009 which includes the CVE-2023-36478 fix applied in commit 467052975e8 on September 27, 2023 [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:20e61298-0179-58ca-8748-8e7c6cf58fd3", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:59217830-7cdd-5525-ac70-7ac2c7e4e198", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8f140544-5df6-56e7-a005-8f3baf6e2028", "id": "CVE-2023-41900", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41900 does not affect version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets. Version 9.4.53.v20231009 is not vulnerable. Summary: Target repository version 9.4.53.v20231009 contains the necessary fixes for CVE-2023-41900. The code properly handles authentication revocation by calling logout() with super.logout(), and the control flow ensures the current request does not proceed as authenticated after revocation. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c28fb285-cdd4-5d54-bd76-cf9303717923", "id": "CVE-2023-44487", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44487 does not affect version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets. already_fixed \u2014 The target repository (Jetty 9.4.53.v20231009-tuxcare.5 at commit 410a3b078eb) already contains the complete fix for CVE-2023-44487 (HTTP/2 Rapid Reset). The fix from upstream commit 0f246d12090 'Fixes #10679 - Review HTTP/2 rate control' is present and active by default. Rate limiting is enforced on RST_STREAM, CONTINUATION, SETTINGS, and other HTTP/2 control frames at 128 events/second, preve..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e2620ecf-d233-5c2d-bad0-381f45450787", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:99d06209-37e0-5a99-8254-0dd542732e7f", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:399c9f48-b694-5f66-b83c-cebd11655f95", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:207583fe-759a-5980-ac21-28b7d72ea4a8", "id": "CVE-2024-6763", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6763 is fixed in version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ad33a202-2879-54e4-a8eb-58bc61273505", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ac085530-8700-51f4-9d4b-3cd9a082b2bb", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:51897215-33b2-5935-81c4-4fab8cc1a0eb", "id": "CVE-2025-1948", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2afce0ba-477a-5a95-888e-241c98367669", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:38286cc8-c4a4-574f-9c33-6a23073fa7b3", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:85f88bfa-5abf-510d-954f-ba63b505fc91", "id": "CVE-2026-10051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9bdb6fc9-10c2-5de4-ae71-d4d952fe1145", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets. Version 9.4.53.v20231009 is not vulnerable. Summary: CVE-2026-1605 does not apply to this Jetty version. The target repository is running Jetty 9.4.53, while the CVE specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.1.5. The vulnerability is related to InflaterPool resource management in Jetty 12.x's completely redesigned architecture, which does not exist in Jetty 9.4.x. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3a156ec8-3b6e-55ea-9d86-99878d363667", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:80b6afff-cc03-5748-a3a2-6693bb72028a", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fc8ebcbd-dfff-5b75-b780-0088aa18bed8", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6f1e0bbe-7148-5fd7-a9e8-ec59afd9f2ff", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 Jetty 9.4.53.v20231009 is NOT affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's single-pass canonicalPath() implementation where semicolon parameter processing fails to update the slash state variable, preventing dot segment detection. Jetty 9.4 uses a fundamentally different two-pass architecture (decodePath then canonicalPath) that correctly normalizes paths containing sem..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cb22eba0-e549-50d2-9b79-e88070565b71", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh does not affect version 9.4.53.v20231009-tuxcare.6 of org.eclipse.jetty:jetty-servlets. Version 9.4.53.v20231009 is not vulnerable. Summary: The target repository already has the XXE mitigation patch applied. The XmlParser class includes the protected newSAXParserFactory() method that allows subclasses to customize SAXParserFactory behavior with XXE protections. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.53.v20231009-tuxcare.6" } ] }