{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4671a995-f20f-5a25-9b62-f34b94567f9e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-openid", "version": "9.4.50.v20221201-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:ba55b7b9-25f6-570f-9056-bb203e3c86e1", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:146e6ba8-080d-5ea9-95f5-0c254fd74a0e", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2d760814-19da-59e8-8928-4b63a4ec41c1", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ed83f10d-d90f-528c-b8e0-4f7014d7b2c7", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:99e9e063-12e6-532c-97de-505db44d2247", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:82bb8216-a1d8-5699-a89c-43833deaeb13", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:41260f1b-fc5c-50bb-9d1e-f0aa7fe4bc57", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:af5c0ef6-b023-527d-8be3-955ae83bfcb9", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:26006cab-c809-5b3a-b9ba-7c4249064f2f", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9fedf69e-7b55-56c6-90ba-b519c8635d51", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3b0c4ae7-b382-5c0d-b20e-68a7b6960889", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6a6e7691-d952-508d-bb13-6ecd42351931", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:475dcb47-7ad5-5e08-801e-441ad92af804", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:72661884-ffbb-5a93-a624-a63f81121dff", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:38a4e632-c13e-557b-bc39-2d9cc0737042", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a58837bd-7b26-5e56-bc06-9897c54fb9c4", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f7223fbb-5c7f-529f-b120-65018342295d", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ae8a68d6-5347-5c25-850a-9f964d1ce6ee", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:149d3f22-967b-58a0-a95c-587d01020360", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9e720ee7-1a8d-5afb-9cf9-378c534872f2", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a3e3c3b1-6d60-5328-b1c6-f8353ef2124e", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:107b8d7b-96bd-5aa4-984d-5bab4161151f", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a74292f2-5462-5735-9df8-b895001e5050", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:de272198-7bbb-586f-8fe8-5d46dfbd9247", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:38022f28-51eb-5988-be60-41349b28f396", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b3d65dba-8d25-5c72-82e0-54c7b68ef1a6", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2348d1ed-99b6-52b4-b159-8110cd893762", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-openid." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-openid@9.4.50.v20221201-tuxcare.3" } ] }