{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5c4866bc-41eb-581e-8d43-9a509a380991", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-jmx", "version": "9.4.50.v20221201-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:4e413ef0-f1dc-5a6c-900b-6aab7f8655e1", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:079736eb-b235-554a-9129-4ccbf6857ae4", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3a0720f4-5f9c-5e65-b528-ff9e0f7f721b", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:24f9e7b9-ece7-5d3b-b1f1-2cdc7208e71b", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d9f8e8d9-8fb2-5edc-bdb7-05dba5b93013", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e8991ad9-a048-5b93-a9be-f47b2ac464c6", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:09a78e4b-9290-5613-bca5-c3c771b08130", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9a896deb-838c-5522-9056-a56bf5e67c16", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f3c1317f-6fbb-553f-b6f2-1934c597d833", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6d45f800-8c80-5159-82c2-f2dde24a7f18", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:250974d2-022b-55cc-bc4a-e28df9bcf813", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:aa839d84-9210-54b3-9de5-91413ae6e732", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cc9bfed8-e571-5d1c-a157-f14b7048bb41", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e3f98355-dca2-5b0c-8e95-335fd0ee3404", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1e4f72c4-991f-5097-a7bc-30fe595d321c", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3855a483-d81c-5906-acfe-53a8ce886d39", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:093a9739-edfb-5eaa-a16e-089d042de2f5", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:39ebc427-0bcc-5775-ade9-f95488d0c989", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8feebb0b-3c14-54c1-bebe-745f118c6fab", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:47f93048-b3d3-508c-9366-d227600f8f39", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:437d48f0-6b96-56dd-a529-66ef7019eebb", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6f9b61c4-a231-53e0-ad05-a70b3e4c387e", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5bbcde27-4864-5e59-bbbd-f773c4413d42", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b2a8fdd4-8072-5424-837e-5a8d8d403de1", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ed48689b-9b29-52e6-878d-b284a285f715", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:48537df6-98f6-54de-8b29-a6316ad35090", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ae79244b-93e2-57d6-8622-a94e677c8baa", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.50.v20221201-tuxcare.4" } ] }