{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:df0da55f-2889-5d09-ac12-ddca40d78f7b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-all", "purl": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5", "type": "library", "group": "org.eclipse.jetty.aggregate", "bom-ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5", "version": "9.4.48.v20220622-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:94d1f625-ddc6-57eb-813d-7d09c71ecece", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:00dee91b-6cb0-582d-a04d-6ff573428696", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28169 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:6cdaa6e1-51ee-5162-9afb-828cf9d702b9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all. Version 9.4.48.v20220622 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:7f7af191-81b9-5cd3-bdca-7f2f15fb34d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:930401c7-b308-5f84-a4e4-0645eaf5a8d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:f9130417-2797-57ef-bbeb-51c76367982d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:06d3e3dd-447e-5a2f-9bb2-1a4780b9b03d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:fd645332-da55-5f14-9c5b-b3d674809f73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:0b1656cb-2ded-56fa-b5a9-b1ef9e83cc87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:9e2e1f28-b03f-57de-9cf0-a5d09c825d00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:8b20e0b3-9a22-56e6-a28c-c3d40fc376ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:ff5d379a-1172-55b5-895d-59d70ec34d9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:0b0a8627-bb63-5a99-ba52-2f49b9620463", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:67477374-e338-5771-b83b-264129bd6bf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6763 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:3ed829e4-5b66-5765-ad71-2e3ca9db8e68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:ddb434ec-25fa-5bba-899b-33ef0be85381", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:53f5ffb2-7e13-5dc1-a59d-10b70e0f9e51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:f8b57372-6624-5ebe-8661-1af7cacf1d5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:3f297e87-65e5-5d18-85c3-d080ba89d097", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:29854fd1-b1d5-5676-a1d4-bfef3ae9579f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:fea64dc3-ca2f-5bee-a982-192b24175ba4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:da177704-8e6e-5ee9-acba-83c653358bea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:8dd4a700-5768-5ed9-9b1c-7374b594427e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:c1d3d9f8-52de-5e88-982f-d4f1f5bb8640", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:5b345b94-9ae0-50c9-813f-61a164932d6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau...", "justification": "code_not_reachable" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:72d2ed5e-a805-5f51-a22c-d2e48c900c15", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ] }