{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1726f682-7ff8-5a6f-9770-69ae8fc7983b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4", "type": "library", "group": "org.eclipse.jetty.fcgi", "name": "fcgi-server", "version": "9.4.50.v20221201-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9c889568-217b-526d-8370-84205c7119e3", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4b6b6fa0-e1fd-5707-9b39-ab4827c7a06f", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:51207acc-6d71-50d6-a994-7109a4ddd358", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2ae1de8f-d99f-5c31-9488-fedd5b8aa26d", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cc06a18e-02ac-5632-b5ab-4a39ed8ae839", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:12779a07-6837-52f8-a920-b9c17d8ba007", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:37f86253-b97c-5370-affc-d1eb864c04e7", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:41deebe1-cf0e-559a-9361-febf44ef55d9", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:08e427f2-1a3d-5f43-802e-bad25367dd36", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2aa134c6-6bb4-5542-a19c-999d875d381f", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:29329249-84ab-505f-aab4-c7c1e22f12b3", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:52e49485-7b33-5d74-85f7-a9654817eeaa", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5c45d891-4c55-54df-a271-34b8f7c8d599", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f2b1d299-54cf-5903-8700-e1501442583a", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:41218b63-40f1-58a6-87fd-f29093119bd5", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f79149c5-9c20-55f2-b1ab-ba65a1ec0596", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bc30e74f-0f35-5a27-8ff3-b6ff65fe7750", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e901f1c4-3bb8-507d-bd91-49e222fadaa5", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c9379043-3563-58fd-9e11-d20ab5d7cc80", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:63ebe1d0-e8f5-56e5-9e14-75e13d40ff42", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e2201dd5-bd00-554c-8600-ccddae19c448", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f6cd0c5d-6a4b-5ae0-b802-f176ad504869", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7aed6071-dd4e-500d-a128-8dce93607be0", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:faea443c-6cfb-5161-9fef-aedb5276c7a7", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b7c96c92-c146-5cd2-a0ff-a66359a62c08", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:353a6d45-ca89-5e3e-baea-d581171a0911", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:978ddd75-8e1b-5995-ac90-c9d8d88d75c6", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4" } ] }