{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:af183cde-9110-5115-a40f-c80c30b652be", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-util-ajax", "version": "9.4.48.v20220622-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8a531f92-ef9a-5579-8396-27439dcec535", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:53e23e5b-07fe-53e8-acae-aa509b8afbeb", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:13ac643b-bae4-5822-89b0-9a37bdedafdc", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e447a2dd-d7c3-5db7-b27b-e01d2437ec47", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:02bf67a6-186a-5218-bd3f-5385673ada87", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e9ffc941-301c-567c-9f1a-a7603a1ae1ff", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:839f04fd-c060-565d-992c-3db51c6de650", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f5e08598-e1da-5c06-a5c8-1d20ec4cbf52", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:62bd00aa-a860-55d7-ad68-3258bbd2cdbe", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:365a343a-5f67-5cba-ae9f-725befee33c6", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2ac76acd-e8f5-5785-ae4b-02b4199e8c51", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c0b6fdd3-4c51-5d1e-ad20-15840c55e16d", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ba988785-70da-58d2-9a5a-d03494874ffe", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aa5b9eee-5c33-5eed-a4b1-6641cdae723f", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a7d7f809-72de-5250-baca-31a77be9627e", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0139a583-8020-574b-96b5-540f54f67512", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:636e75bc-bf73-50cc-a248-2fe3afdccdcd", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8cd353d4-ee8e-5f00-8907-d277b05f2cbe", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:02716d91-81a9-5aff-899c-c44af4be9359", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4a506f5c-3308-5fb9-8deb-3c8cfcfd62f2", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:69a05841-853e-5700-900e-a6c50800be7b", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bb1603c3-55f5-5023-a8fb-1359675183c8", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bbe31df3-97c9-5343-bd74-e91ac9388d20", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1980f80d-4df8-5692-8a45-6ef0e8741bbc", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:96a5e7c9-1979-5044-b040-386348ec7900", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:72d61f5f-4820-5a0c-a872-110fe98be7ff", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-util-ajax." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.48.v20220622-tuxcare.3" } ] }