{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a6ce856e-7da4-5405-b8ab-52afc736e022", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3", "type": "library", "group": "org.eclipse.jetty.osgi", "name": "test-jetty-osgi-webapp-resources", "version": "9.4.50.v20221201-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:845d657a-313c-57a4-84f8-e94dfb8ecb17", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:46c76f91-d9a8-5e5c-a006-64e23dff4c32", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a11a185a-e2de-5b4d-8dc6-305197809a69", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e0f14e31-a068-5807-9ac7-7f189f927782", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fb984be2-a5ee-5a54-bd23-0534ab26b3aa", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a5b80aed-97b5-5668-aee5-dcb57b1b4a07", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9807ef2f-2326-5721-8a00-0a07004fe6c4", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0351663d-12c5-57d6-862d-0a2922e77d76", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7edb8da2-2776-55ab-8a6c-f2b552b7cddd", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:65a6b7bb-f474-59ec-b5e1-2decdef6d794", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5e0b4fb7-b76a-54a8-a7c7-855697013ef0", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:33b630e7-fc85-55bd-abb6-10437b28ec87", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:189c3fef-05b5-5921-b942-ae5e1c6e9cc6", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fde86b1f-2e06-5112-b211-21ab91dca118", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b2afce75-0add-5380-8e7d-4bbff260792a", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8eec6f93-a3d8-51cf-b5e9-38f4cec503f4", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:58fa0089-666c-5655-94d1-12bc1c8eeb12", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:930d8303-531e-57cc-ab02-a9524de68a9d", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e8f2fee3-06cc-58de-87f1-a0ec4e14d5a6", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ddab46e9-0521-5e33-8220-2b68f2578298", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:15e5b2e4-de79-5861-8008-0e01224951b3", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:73cf46a0-7131-5a07-814e-36aefe7958cd", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:33730b18-f1f7-57fc-a871-ced81400376b", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:183b2cd5-75ac-5ca5-bc3b-3cc95d2bcbf1", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:eee845be-2f8a-5fa0-984f-386238509783", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a3557f33-ec63-567f-b92c-52ca6e93eff3", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:11359f9e-9571-5ed2-a060-79aabc22b941", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/test-jetty-osgi-webapp-resources@9.4.50.v20221201-tuxcare.3" } ] }