{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:48deffcc-bde0-5d6e-b5d6-6a9ef30a2f69", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-server", "version": "9.4.50.v20221201-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:bb834576-a4a0-5c35-9f71-2aeec0d40cd7", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:57de5538-ee19-5407-90c1-d3b1a3d84c75", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a4f3fb80-bb06-54c7-8b0b-2f7af16dc530", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0c3853de-fbd4-551d-8ddb-7d3cb5256e85", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:deed4020-3345-5bd5-99c9-354c77577350", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c22b75e6-e5b8-5315-a8ee-b81e73fced2d", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8a80946a-931d-54ee-b6cb-0dba7da241d2", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:02dc23a3-5f8f-57c9-b357-a70c34f47c1f", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8f6f145a-d4b7-508d-ba6b-685450254261", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ab6a097f-e254-5e09-a173-b808a3f7c2af", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ba09b34a-17b7-562a-b21f-9a17e37be181", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0fbc7100-5e6a-503c-927c-876d0841a8e3", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9852df0c-ccf2-52da-8d78-608f24ae2964", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:751184f3-ea53-5372-8b05-0005e5166918", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:93878833-e674-54cf-8706-bdd63d85a490", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:955e5cb5-a6e3-51da-a024-90f6fdf8e61c", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:976c1a51-c62c-52f0-8b13-b82e71baddd4", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b399769c-ce0b-542a-8b9f-bd3abe8558e7", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:41411fee-7305-5626-88d7-0bec442a50d1", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9cc28ac5-ffe6-5f4d-90c4-40e318bd10c3", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9ffdc35a-c08d-5fdf-9a53-335aa3a4b394", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:29afc2af-d36e-5388-ad2d-b4288fc66c5a", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:127e6469-7de2-5531-be5c-82cf2e1eb249", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d75eaa38-fb70-5782-b3cc-41c882903734", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b1d4efa4-5b7d-50d6-84ab-0bb827645d52", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ad82a969-1a5f-582a-a8ef-947db023d722", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:29930c08-c039-57e4-be3e-7d29aff77b98", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty:jetty-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.50.v20221201-tuxcare.3" } ] }