{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ff6de47d-ec2f-5b6e-8a31-63a9ce3d00ea", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-util", "version": "9.4.48.v20220622-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3f5aac8d-1bbb-5d7c-8d89-8e632b738d10", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7b7d84c4-194d-5fe4-8aa0-5f7c3777a509", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1e27a7b3-884a-5df4-a7f1-e68b257c53a5", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d0e15de0-f998-5a41-b794-50138d5146f1", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:39ce0ae4-2828-54b9-b9de-1a16e7d1a52c", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a992027b-80fe-5992-bf47-0372eb36284c", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:de41bda3-84bc-5f64-a477-45b88f543a91", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ce057ff1-8cab-55e1-8a8d-70513acad0a4", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7c7f85c9-2b66-563a-b625-0f2fa188891c", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8ad5175f-2647-5745-b7f9-d020b32d0c7d", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6d003b0c-0d4b-5020-8c38-48270174936f", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9a992459-11da-56fe-8b48-ee35d4fe98e6", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6e6e3aee-9676-5564-b456-d45c7e61c952", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:95f89389-f51c-590b-8aea-1e656b381049", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bbfa4265-725b-550f-be31-b7eb219c2102", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:37784713-3f68-5f08-bca4-dde7090b2cf0", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:08b8f0a2-6bbc-51d8-84fd-e8eaa65077ae", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9a6b5847-c4e7-52f4-aff3-e104e3033de8", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0b11c099-a535-5964-81c1-b78aef6ded7d", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e1e30e5a-0d2b-55dc-91f1-f13d233b7d0b", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:97f4a9d5-655a-5104-980f-813dfe7ad5af", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:863ff063-d225-57f6-9df6-6cb662689ac4", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2f180b62-40d2-5754-9949-8b675c0408ac", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1beb3b51-ef66-535e-84e3-346eee2ba6ff", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:66c18354-e16a-5260-b5c5-4f05c80bcba5", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2ba30dd6-4b99-57c6-82bc-e7fbba99032a", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.4 of org.eclipse.jetty:jetty-util." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-util@9.4.48.v20220622-tuxcare.4" } ] }