{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6313937a-766b-5931-be82-8679e27851b2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-websocket-tests", "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001", "version": "9.4.65.tuxcare0001", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:54eb9b39-c9a5-5019-a92a-88fdd2806759", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:5d947687-f107-5281-bd70-fac9a9057c61", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-28169 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests. Version 9.4.60 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The ConcatServlet now properly validates paths before dispatching, preventing double-encoded path traversal attacks to access WEB-INF/META-INF protected resources. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:b1c6e215-973e-5845-8f88-a3d069b46572", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests. Version 9.4.62 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:99f44a2d-ea61-5ccc-904c-c3d572bd25c4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36478 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests. Version 9.4.59 is not vulnerable. Summary: The target repository has all security fixes from CVE-2023-36478 already applied. The repository is NOT vulnerable to the integer overflow attack in HTTP/2 HPACK header processing. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:710ba752-1e41-52dd-b6a6-1576129125e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:fdcd217d-e0b5-5f89-9a20-17db60cd1763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:1edcd21e-d023-5657-afb4-c353f5b82635", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:34202784-de73-521f-b6f9-928925295bb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:85a3961b-3b62-5c49-b045-a4b706307807", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:a7d73cfc-291d-56b9-a391-9290c1e84d30", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:c1848d50-84eb-54bc-83fd-3c2e08b539c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests. Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:65c081d2-7afa-5599-823e-1b2426d7598f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:220d72cb-7507-5b53-8d7a-cdf9ac6a0c07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:5817915d-ac1f-5509-a6a4-7f9cb2c802da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:7c29d6fb-ff4c-5b69-a096-1fba5b354135", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 Version 9.4.x uses a different architecture than the affected 11.x/12.x versions. The vulnerability requires a connection-scoped HttpConnection._trailers field that is never cleared between requests. Version 9.4.x instead uses HttpChannel-scoped _trailers that IS properly cleared in HttpChannel.recycle(), preventing cross-request trailer leakage.", "justification": "code_not_present" } }, { "id": "CVE-2026-12611", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:9aa1787d-0729-53af-ac05-a849f95c171f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-12611 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:1d7a3401-c57a-575f-aba8-88b75e19c33d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests. Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:ce1c7a3a-8e32-566e-886e-60077e45c286", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-18659 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:fe6b45ea-f5d9-5321-922a-ebb8242b7055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-18660 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:e5ed0e19-3ad9-5b14-94a7-7e61d838f4a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-18661 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:825560ab-6044-5684-be5b-ff16006e30b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-18662 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-19203", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:25127206-f632-5b94-af1e-122c4b7d1c83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-19203 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:6234b33a-5b7e-5c97-995b-7ee19a3c78bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-19864 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:2978ec99-ca9e-55dd-8ab7-8d3518639bab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:6000d06f-a96a-5dd3-a76d-1ef49f3228e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:b471d087-f90a-568a-8038-12c28ff9f692", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-76182", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:6ded920f-0300-56bd-96c6-7f22ae10f496", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-76182 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-76184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:28f41907-3a86-5d97-b3de-7850c73b0dfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-76184 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-77711", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:2f1ebf60-f673-5205-bf07-a18a8c54f3d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-77711 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:f3731ae1-f51d-5250-b222-765e0522b891", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 Jetty 9.4.62 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.x's integrated canonicalPath method that both strips path parameters and normalizes paths while tracking a 'slash' state variable. Jetty 9.4.62 uses a different architecture with separate decodePath and canonicalPath methods that correctly handle the semicolon-dot-segment pattern.", "justification": "code_not_present" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ], "bom-ref": "urn:uuid:73f2e318-7de5-5e7b-8697-0e5b6007a488", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 9.4.65.tuxcare0001 of org.eclipse.jetty.websocket:jetty-websocket-tests." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.65.tuxcare0001" } ] }