{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:11600124-a89d-5b20-95ab-8fbc5c32ccf1", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-alpn-parent", "version": "9.4.50.v20221201-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:037a788b-2f8f-5393-b4d4-62658b5d5478", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8833dfb9-e75c-578a-9ddb-4ea0fa7ca177", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d7699bde-04fa-52c6-a58e-37c62b9ea870", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ad672b16-d1eb-59c5-9ded-f08301f496c7", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9b9dd89d-ecd9-55ba-b444-3af441b564b1", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2b37773d-135b-56ce-98bc-19134cc1f651", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e9fdbfda-53f9-51ac-9050-0e65a2ed8ec2", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:088ab32e-2ce9-5f85-811e-ba136f79d4dd", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a891ad2c-8e8f-58d5-bf64-ce04b8c226b1", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:35bc86ef-6502-5e69-a87a-cf5ba5b24251", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4c88ca00-47fe-51f9-9387-875e82502ede", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3a4bbd0a-5036-5bf4-8292-49558e693f1d", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e995642a-f6f2-5711-86e1-00b965ba5326", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f7964434-1704-52ad-bbe2-4d52fdec5656", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:88463f76-accf-5fac-b347-9042ddbd9f81", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f37e2771-17e1-5994-aef4-4e0c6f015681", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:50157273-c3b7-59d0-aca1-50bf0701c45b", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:390db60a-bfcd-5778-9076-e63be6982207", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c46af1b4-0bda-58a7-8fe3-4d2f086af48d", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e4891824-65cd-5ba4-8366-cf911c37228e", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7520030e-9382-5900-8d2d-0333ad8783f5", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:736124cf-8519-53f1-8992-8dc33b537315", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:60ad7243-72f8-5bc0-bed4-d1bcb686829b", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a1375711-e94a-5696-97de-2362b9460c40", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:64d8fab3-016c-58bb-a39e-3473eeaadea5", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:12abf74d-a2df-560a-afb3-1d92dd289ced", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:036e3e7b-0160-51f1-861a-7f49089b256c", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-alpn-parent." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-alpn-parent@9.4.50.v20221201-tuxcare.4" } ] }