{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b286e576-56c5-5b02-b907-1808b97bd44f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-nosql", "version": "9.4.50.v20221201-tuxcare.4", "purl": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:54f9ce1d-23ff-5d9a-b048-8eeda506cb5e", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2f0b2e88-ff9d-5475-8383-d40a8ef7d850", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:db45ec74-685e-5345-89d3-3edc7a8f30bf", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3ab11673-f170-5840-b786-8ad74cfba10c", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8a044b2b-9f8f-52a6-8e8e-647635fffb3d", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:792b47ca-0f13-5f86-aacb-85fad6994676", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:382082c4-86b0-5cb9-999c-33b92ad4f786", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:992e0a5e-f5c3-5e8f-bf79-32c480ab0c35", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a9a0cc73-0050-5b5c-8fea-67c38973f3f1", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e6ce13da-443d-5407-a0b5-8cbc6e4e4355", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bc60df51-cc79-5ca3-ab86-d9df1de50593", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8b250f16-73a2-58de-ab4c-6ec66f7f4b92", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:32405211-a118-5536-8d07-400b47272d7c", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e0fdea6e-b3a6-5a05-be47-959747b16ce3", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:46b2a343-ec09-5fb2-a9f7-08bc9519cfe8", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c0d9b956-9478-5df6-99a0-85abe65a85a1", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fbe54147-10d0-56fa-9fa7-02abf073b421", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:17d8309f-2052-5a55-b113-4314afa4ebb4", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5fd92594-b1e0-56bf-99ae-273d8a7e1285", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d13aa598-3845-54fb-a41a-f8f0409661af", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4c07021b-00e9-5ee9-8181-1cf04fc31c22", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:39fb16e8-8197-55a5-8526-c3885e6a7ef9", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:222e25c9-158a-503d-b6d2-682ae963536e", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d9e65b09-a31e-57ea-8f25-badd480b8f4d", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cbb59aad-418d-554a-bd00-2ab524040028", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a2639a7d-7207-5026-b22f-ff2bdbe65fbb", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8acc210b-406f-588b-98e8-fd43e2459d25", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty:jetty-nosql." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-nosql@9.4.50.v20221201-tuxcare.4" } ] }