{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:23c10f15-3598-5910-b473-a6f4fd3fba37", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-unixsocket-server", "version": "11.0.26-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a7c5cd83-471c-54fe-972f-570d10468c84", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6bfd96da-f454-533b-b77e-ed7a4a4c7cbc", "id": "CVE-2024-22201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e5845881-799a-5da1-85fd-9f0e640b7e32", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0e564b6e-fc55-5f45-91f4-3367cbbbfda1", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:43615aa5-ec80-5a34-8b15-b6b533d9b967", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7e25b722-1342-5c15-8683-877cfd1eb4bc", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a285abf6-51eb-5437-9d56-d085ad1dc91d", "id": "CVE-2025-5115", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server. Version 11.0.26 is not vulnerable. Summary: CVE-2025-5115 (MadeYouReset) vulnerability patterns exist in the codebase (HTTP/2 WINDOW_UPDATE with delta==0, window overflow, and DATA frames on half-closed streams all trigger RST_STREAM from server), BUT the mitigation has been applied via commit a05e1d031d0 which implements rate control on server-sent RST_STREAM frames (default 128/second limit), preventing the DoS attack. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:182b4b7e-ce46-557b-8ebc-404da3f3390c", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:beaa6025-b2b7-5c27-916c-16f9fbb8f515", "id": "CVE-2026-10051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8ff3873b-23df-5755-beac-467cbe4ccd03", "id": "CVE-2026-1605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9513af5f-cde7-5518-8072-daaf09f905a5", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:43412aea-7fb7-51a5-b7d4-950de62a1b2d", "id": "CVE-2026-5795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:df6ef99d-7dc9-58b5-9383-b14c5c7e8855", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7889d157-fa35-5af8-ac69-a209c3b958c2", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server. not_affected \u2014 Jetty 11.0.26 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12 where URIUtil.canonicalPath() integrates semicolon path parameter handling with dot-segment normalization and contains a slash state tracking bug. Jetty 11 uses a different architecture with separate decodePath() and canonicalPath() methods that correctly normalize paths containing semicolons." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8ed0d965-78dc-57a2-a536-156bf9ade5b5", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-unixsocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-unixsocket-server@11.0.26-tuxcare.2" } ] }