{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fd8360ff-2f8c-55cb-b3c6-93c39cecf92b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "websocket-jetty-api", "version": "10.0.26-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:03d89a75-61de-5494-aeeb-69b3b4869925", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f0d21b97-c041-5664-82ed-5b17f0ee5ca5", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fb3f0cc0-f950-5f5a-831e-628aae141f49", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e5cb5c31-fe40-57e2-95ca-897a042c81d5", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d7a7575a-8af8-5c85-914b-3a860a8d8e38", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ecba2960-e81d-561a-ba5e-6fb1a3a26144", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:79a4670b-0b61-502a-89fe-6a736e96cb43", "id": "CVE-2023-40167", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-40167 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api. not_affected \u2014 Target version 10.0.26 is NOT vulnerable to CVE-2023-40167. The upstream vendor (Eclipse Jetty) applied the fix in commit 003e46cae4d7 (2023-08-18) which replaced the permissive Long.parseLong() with strict character-by-character validation rejecting any non-digit characters including '+' prefix. This fix was already present in the upstream Jetty 10.0.26 release before TuxCare initialized their..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5e2414af-6765-5e30-bbdc-ee249be2144e", "id": "CVE-2023-41900", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41900 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api. All 1 patch commits already exist in target branch" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4123d4f6-df46-51a6-be51-a5cdb00f27f1", "id": "CVE-2024-22201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cf0e5b81-463b-5d18-aecf-4e5ba2676705", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:667fc84b-eb10-51b1-96f2-30d8937b6dd7", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:38f9fd91-e326-53a0-af2d-ae6634228fdc", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:66f57ce2-cca1-58d6-9e60-658f7241092c", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4ebf64c1-2d88-51b4-948b-7b74973e84d8", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cff17858-b98f-54ca-94d0-c8b4447898f2", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:27df592f-9f72-5b95-b8dc-3354ac594e77", "id": "CVE-2026-10051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:89c23a25-5fb6-5a1d-bf6d-04703d1d1d37", "id": "CVE-2026-1605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:18b090c9-2b6c-5f44-b55c-34716a497acb", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8555f249-49ac-5ee8-8758-fe2bc4488325", "id": "CVE-2026-5795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ffbb8fe0-b098-55d2-af26-d651e9a1c5c9", "id": "CVE-2026-6790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bd559041-0c20-557c-8617-50b713074007", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api. not_affected \u2014 Jetty 10.0.26-tuxcare.1 is NOT affected by CVE-2026-8384. The vulnerability requires Jetty 12's specific architecture where encoded path processing and dot-segment normalization occur in a single method with slash-state tracking. Jetty 10 uses a two-step architecture (decodePath then canonicalPath) without slash-state tracking, preventing the vulnerability chain from forming." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e9210c96-fd3b-58c8-bdd0-515732aa1012", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 10.0.26-tuxcare.3 of org.eclipse.jetty.websocket:websocket-jetty-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@10.0.26-tuxcare.3" } ] }