{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a91092fa-d025-5b0b-9726-ae8f19f5e4fc", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "websocket-core-client", "version": "10.0.26-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:79b3af98-9210-53a1-ad58-5d78c4e92e1b", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5f8915c5-af8d-586a-91fc-3f3e298d0d99", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:77fa9f77-1883-5cf3-b26f-4f2f61a5fc24", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:458a08c0-17e5-52e0-a1c8-3ed219481476", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e040eb6a-59c9-52ed-ad3b-15a355454e83", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:54c4463f-7efa-54a7-93ff-c26be3afd59d", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:72125388-e6d9-5032-9147-2e3559d37d3d", "id": "CVE-2023-40167", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-40167 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client. not_affected \u2014 Target version 10.0.26 is NOT vulnerable to CVE-2023-40167. The upstream vendor (Eclipse Jetty) applied the fix in commit 003e46cae4d7 (2023-08-18) which replaced the permissive Long.parseLong() with strict character-by-character validation rejecting any non-digit characters including '+' prefix. This fix was already present in the upstream Jetty 10.0.26 release before TuxCare initialized their..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7b76133e-0eee-5cf5-8137-dc4f53f54ddb", "id": "CVE-2023-41900", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41900 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client. All 1 patch commits already exist in target branch" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ab14618f-f67c-5e7a-b33a-ff817c236575", "id": "CVE-2024-22201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:61ab59ac-c91d-533f-852b-44c7d1b0b331", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9d3dffe5-e666-5136-8c73-b57284b3efd2", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:31b8a432-db66-53df-bb61-a2d43778d670", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2455c566-e85a-5a58-822d-1b00a2b1c7f8", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4de7171b-589e-5bf3-89e6-fb3a7783cccd", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0a8e8b09-99d1-5b59-aa0b-8d1137b6b5eb", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9564704f-a80b-510f-b3c9-7902ea6ed13d", "id": "CVE-2026-10051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:29d0672d-42ed-5848-98e8-990b785c1312", "id": "CVE-2026-1605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b6a3a723-dfb2-518f-89d8-44e6c5ad05c5", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:75020936-716b-54d7-a1a7-856feda10734", "id": "CVE-2026-5795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c2a03523-e0a9-5319-b2f1-4a6419504264", "id": "CVE-2026-6790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6cebf8ab-1a60-5f7f-84e1-39b84747e7b1", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client. not_affected \u2014 Jetty 10.0.26-tuxcare.1 is NOT affected by CVE-2026-8384. The vulnerability requires Jetty 12's specific architecture where encoded path processing and dot-segment normalization occur in a single method with slash-state tracking. Jetty 10 uses a two-step architecture (decodePath then canonicalPath) without slash-state tracking, preventing the vulnerability chain from forming." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:28d3f750-71fe-5fa0-b1a5-61d3aa75d7bc", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-client." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@10.0.26-tuxcare.3" } ] }