{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b5c31f3c-b143-52a1-b46b-7146e99834b4", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "websocket-core-common", "version": "10.0.26-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:eea1d570-57d6-5092-bd4c-2c55c701833c", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8f7da46a-af7a-548a-a85f-20601cd070a8", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9f32fa5b-a643-5b70-a0fd-5e29879b373c", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5f4bce1e-1967-54f8-873a-e36a795d4756", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ea9221d2-6c82-52ea-a1d1-16850a578f1b", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1ab03105-acfc-5205-ae90-0857b0974241", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7b3e0e5f-68da-5439-b911-89b89d07cc94", "id": "CVE-2023-40167", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-40167 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common. not_affected \u2014 Target version 10.0.26 is NOT vulnerable to CVE-2023-40167. The upstream vendor (Eclipse Jetty) applied the fix in commit 003e46cae4d7 (2023-08-18) which replaced the permissive Long.parseLong() with strict character-by-character validation rejecting any non-digit characters including '+' prefix. This fix was already present in the upstream Jetty 10.0.26 release before TuxCare initialized their..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8f5ddb63-0682-504b-a2e5-5cb34748a128", "id": "CVE-2023-41900", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41900 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common. All 1 patch commits already exist in target branch" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a9e9f2e4-f932-571b-9bee-4c7b1f48d2c2", "id": "CVE-2024-22201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f3068517-e690-510e-b488-61ca86667f82", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:80963e8d-9423-56b3-9312-3deabd3198b3", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b09a57dd-2987-55cc-b425-ba4db83c6ea5", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8c344e6f-4c6a-5388-bd1d-884fbdf446ea", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4a9ca3d3-201e-5b13-9c3b-2de6fe28fa8b", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b83c2f53-383f-51e1-b77c-0071e55214bc", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ed613a4a-d1f1-5c03-aa79-9bd903ac0862", "id": "CVE-2026-10051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:46e1390e-853d-5d5e-836e-5363133e5dc3", "id": "CVE-2026-1605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:95d85dc6-db04-5e8f-99f4-9299f7767682", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:172f070a-b3ef-5300-ae7a-1a567ca5d6c4", "id": "CVE-2026-5795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:39061a91-c65f-5e46-8998-2479daf8d38d", "id": "CVE-2026-6790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2f7db50f-c7d0-56ce-9e05-6bbb5c89d5f5", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common. not_affected \u2014 Jetty 10.0.26-tuxcare.1 is NOT affected by CVE-2026-8384. The vulnerability requires Jetty 12's specific architecture where encoded path processing and dot-segment normalization occur in a single method with slash-state tracking. Jetty 10 uses a two-step architecture (decodePath then canonicalPath) without slash-state tracking, preventing the vulnerability chain from forming." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:12de33eb-f7f9-597e-b2a5-bcbe9657f838", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-core-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.3" } ] }