{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cf41a45e-9c0f-56f4-9687-1a9a024e0bcb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "websocket-core-client", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001", "version": "11.0.27.tuxcare00001", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:7e214b72-4455-5f86-b4f3-6afb7bbbce2b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36479 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client. Version 11.0.27 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:1787aa6b-f04b-5dc3-98e8-5fc8b40af8a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22201 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client. Jetty 11.0.27 is not affected by CVE-2024-22201 according to the advisories", "justification": "code_not_present" } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:a8328c2d-5bf0-5851-a1d6-ab9b64bce6ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:91c2a3e2-ec0a-5a77-a012-f559175c6cc3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:c2664e6b-4c9f-58f7-880f-16edb2436074", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client. Version 11.0.27 is not vulnerable. Summary: The target repository already has the CVE-2024-8184 fix applied. The ThreadLimitHandler implementation uses atomic compute() operations with reference counting, preventing the memory leak vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:b5c3c457-4529-5c97-a59a-1a7456d02e8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:2b0fcdaa-4d72-5481-bab7-b9459dde201d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:ea3038cc-51a2-56a4-bd00-f3753858593d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:7ab0245f-cb00-5f6e-ae62-17ef1ae1aa6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client. not_affected \u2014 The target repository (Jetty 11.0.27.tuxcare0004) does not exhibit the vulnerability pattern described in CVE-2026-10051. The CVE describes a connection-scoped _trailers field in Jetty 12.x's HttpConnection that is never reset between requests, causing trailer data from request N to leak into request N+1 on keep-alive connections. In Jetty 11.x (the target version), trailers are managed by Http...", "justification": "code_not_present" } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:57d0e0c1-83b1-54d4-bc4d-da66299a3382", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client. Version 11.0.27 is not vulnerable. Summary: CVE-2026-1605 does not apply to this Jetty 11.0.27 repository. The vulnerability specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), which has a fundamentally different architecture than Jetty 11.x. The vulnerable code patterns and files (GzipRequest, GzipDecoderSource, ContentSourceTransformer) do not exist in Jetty 11.x. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:241ccb91-08d2-5676-90ff-41e78739267f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client, and is fixed in 11.0.27.tuxcare0003." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:f03a1e59-739b-5b40-a6f0-2e84b1fbc4ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client, and is fixed in 11.0.27.tuxcare0002." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:95ee99f9-39d8-533b-9c00-0a1d4998891b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6790 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client. not_affected \u2014 Jetty 11.0.27.tuxcare0004 contains an upstream-authored fix from commit 5f25f5b389d (Feb 2023) that validates Host header against :authority pseudo-header for HTTP/2 and HTTP/3 requests. The defense rejects mismatched values with 400 Bad Request before application logic executes, preventing the dual-host-identity confusion described in CVE-2026-6790.", "justification": "code_not_present" } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:d1a985c7-6755-5d2d-99e5-a6fab8bb48cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client. not_affected \u2014 Jetty 11.0.27 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12's integrated URIUtil.canonicalPath() method that attempts to handle both semicolon parameter stripping and path normalization in a single pass. Jetty 11 uses a two-stage architecture where decodePath() strips semicolons and canonicalPath() normalizes dots as separate operations, preventing the bug from manifest...", "justification": "protected_at_runtime" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ], "bom-ref": "urn:uuid:c1d8c8b1-83e1-5161-8274-6920eb3d67f4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.27.tuxcare00001 of org.eclipse.jetty.websocket:websocket-core-client." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare00001" } ] }