{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:69782978-c7bc-5180-95c4-cf666a86c950", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-project", "version": "9.4.50.v20221201-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:54ddf742-ca85-5940-9700-2f4884aa2523", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2b7c2387-028e-5b6f-9663-bb68a8b9c7ea", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9286dcea-73a7-54ed-a722-fe8321e83636", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4a423de2-da02-5826-93a0-733dbb80e878", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cdea3191-03c6-56f5-b040-46ef7c2b4581", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9fe4531d-d80e-53df-9abd-2b511eda6231", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:323eb264-1c16-5b9e-8b7a-bd0dd0db093a", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ae510dee-04a6-546d-8991-5326eac54c99", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:615e968f-7249-558d-9463-1e7356e56f60", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:68bf4d21-47c9-5ec0-bae8-490435627cf3", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9d82ceb3-1bd1-515a-864e-c12868a44ec2", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:58b10135-b56f-5dd9-a836-b153262a1994", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:50094d36-c6e0-5e58-80b9-784622b40d1f", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8198dc94-bb63-5edd-89a7-45d7c60d360e", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:89f2ac6b-2d48-5f0c-a8fb-1115ead64d49", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9a9052d0-c5f7-56f5-8b31-3754538a4055", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c4e6c6ff-788e-5a6f-84e0-2d755d8f4dc1", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a77ea9b1-7e10-51cb-bab8-5e8c96cb019f", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:be13c9e7-7679-5cfe-89a3-3faa953637e3", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5ec7f642-8249-5b7b-8339-b5a941b30902", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0014498a-827c-5677-aa84-0c138318fa97", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fae12072-237d-53ad-aac6-6be53daf045a", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:38233846-0cfd-548e-8898-3c3ad0c42d5d", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:205ed6cd-39cb-5944-a643-8b1d68f0d0c4", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8ca55a5f-4da2-5884-8414-07b081d6a8b2", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:545e6426-0d62-5b76-8431-8da312428062", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:289e61f8-9178-531e-8759-1317fb3de82d", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-project." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-project@9.4.50.v20221201-tuxcare.3" } ] }