{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b755d74d-4b50-5808-8e1d-f33939b34f52", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-http", "version": "9.4.50.v20221201-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:40e19338-f35d-5b10-89ec-b6c30e845540", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6c9a35a8-a29c-5ebc-9cf3-4f42328d9d63", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2c00ad67-3331-5f82-a656-d983819297df", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:da39430d-2b1e-5200-bd98-2a808e2b8b05", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:710e319b-78c7-5886-9d12-4b5f9e454ae8", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9553f125-b8c1-57a8-ae79-e0b9f3567b8c", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c4974b45-c3cd-55b3-9381-220cdf412077", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:14e4db82-2d89-5b7a-a63b-0c007b6835df", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d7c50ff7-600d-56eb-95f3-28588aef77d8", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ee1f96ab-b15a-5cf4-baa4-ca68cafdc867", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d826e497-f798-5fbe-ba5b-d46253565405", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3fa1296b-1d6f-54e5-a895-4b47bbe3ffd0", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8153ecbc-5158-599d-a708-52462bc82ce6", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:34c6ec4e-186d-5427-88aa-fdc265d728a3", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1f2aaa14-082f-5b3c-afb4-413aa2d9e8bf", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:10bae40f-8af9-56b6-b4db-5c1bd46880e0", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d0b366d9-0fff-54fd-9cb0-05068e62fd03", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:23207475-ac2f-50a7-aef7-ede3a51a8bc2", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:418bef3f-6204-5744-b214-9dd7cb0a5173", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f2279713-1d51-5344-bd3e-4748b644c90f", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:05bda6e4-051c-5b7e-8d45-fcfbd2666ad3", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fbba8023-8392-55dc-b1b6-3ea3de8a0f95", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2119bff0-f3d3-542e-b784-793d6b70a0a6", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:eaaa2374-a3bb-5998-a70d-c30229d6ebb8", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8dff77cb-2982-59a1-a5d0-19bd4a4b6261", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:974c25a2-ce78-504e-9637-53cc086d62ed", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a02cd8a7-44d0-53e6-974d-45fd2d28b5ce", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-http." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.50.v20221201-tuxcare.4" } ] }