{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9d07d557-449e-5515-8e0b-fc7cf9a155b7", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-xml", "version": "11.0.26-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:636c2829-5cf8-5305-888e-c0c58e3f2128", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:160f24a5-ed4b-5b3e-a759-288b1ad73760", "id": "CVE-2024-22201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3e351392-f38e-503d-b193-24a554b3afaa", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7505215c-ebda-5c04-87dd-c3dd3972bba8", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:90937f4b-b887-5765-9ce1-53b500c14d5c", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5c60fd94-5e58-5ea7-9123-5fece58a935c", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9293c5ca-90fa-51b4-94db-0883c58f2a8e", "id": "CVE-2025-5115", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml. Version 11.0.26 is not vulnerable. Summary: CVE-2025-5115 (MadeYouReset) vulnerability patterns exist in the codebase (HTTP/2 WINDOW_UPDATE with delta==0, window overflow, and DATA frames on half-closed streams all trigger RST_STREAM from server), BUT the mitigation has been applied via commit a05e1d031d0 which implements rate control on server-sent RST_STREAM frames (default 128/second limit), preventing the DoS attack. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c876c640-ddde-5924-909c-b236c3d1b32b", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dfc825d7-6caa-5fb1-9c15-44569be3cdcd", "id": "CVE-2026-10051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1ed56275-91bd-5936-b2ce-6758c5ba8d71", "id": "CVE-2026-1605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8e320964-3160-5b9d-b7d2-199f0daf6b83", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dc54de86-42e9-5668-a6db-ff0dfb03a3cb", "id": "CVE-2026-5795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2c38d86b-445d-57ef-a8a5-9515f7a236b0", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:863ca4ef-4514-5dde-9961-59caab670c6f", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml. not_affected \u2014 Jetty 11.0.26 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12 where URIUtil.canonicalPath() integrates semicolon path parameter handling with dot-segment normalization and contains a slash state tracking bug. Jetty 11 uses a different architecture with separate decodePath() and canonicalPath() methods that correctly normalize paths containing semicolons." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bd9b5dbb-3c78-5564-b33d-285fa6ee860e", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@11.0.26-tuxcare.2" } ] }