{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3eaa34c6-3d30-5e6b-bd75-92f49212dfab", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-alpn-openjdk8-client", "version": "9.4.50.v20221201-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:48683e85-4efd-503f-b757-f079ffc88e35", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f89f1034-0555-5b78-8d90-09d8556646a6", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c21fbaff-da9f-5616-b72a-7f8c1b740af3", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7684b7a0-e01c-5fbc-8f29-54133bdfd002", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0bbcae3e-c61f-5e9c-a373-e3faf19146c1", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f706be4e-f8eb-5480-97bc-04f2c023e565", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c08f7847-e3ab-5fc5-ae02-affa4459272a", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2cf06895-7bd9-5931-9c06-4ffbd760fb75", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fb096207-5f0c-552d-a5db-25a6f01dd4ad", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:19649a8d-e431-53c3-b2c4-d900e20abb89", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5c2eed25-88f8-51be-8cd5-b9a9ca1ee671", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3c92f4b4-8068-5132-a04c-9f89b33d8a12", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d74f2839-f6eb-5e62-9ac4-b9c6e42a3ca4", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:281ca4dd-f67e-5b3e-aff7-8e7cbc701a14", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:083abddd-4cb7-5566-954e-657995d5b9c9", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:48802c07-25da-5972-bf97-19ce6a7e4c4f", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7bec15ad-fa47-5bad-879b-70ac3ccd767d", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:65c71d4e-d865-59db-bc30-baa602638a9a", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6dc03ae4-63c5-5dc4-8622-7f98b6f924f7", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:10f37891-6404-5f60-b048-0464782482ee", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ab27ebc5-1864-5352-9b79-42396053d0c1", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d52a7156-610a-5800-b844-6d640125d193", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c097218f-5847-5e18-84e5-9423a582d5d4", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:832d4e76-cf04-552c-a25f-869465f4f9c5", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:563fa335-13d6-50e8-9e4d-aa1317a45f39", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a72d52c3-b108-585d-b7f1-f68b798c3680", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bff01f44-4624-5b17-a2f0-d4d2c53e3cf8", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-openjdk8-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-openjdk8-client@9.4.50.v20221201-tuxcare.4" } ] }