{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7d5d1a0e-55fa-5ece-b4f5-e97b4ec3266b",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3",
      "type": "library",
      "group": "org.eclipse.jetty.http2",
      "name": "http2-hpack",
      "version": "9.4.58.v20250814-tuxcare.3",
      "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:51d68aa5-4b88-5feb-9a07-f9d12c32c632",
      "id": "CVE-2020-27216",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27216 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:47a32710-6783-572f-80a7-6a9e080fef8a",
      "id": "CVE-2021-28169",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-28169 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:37904e91-09af-503a-ba00-7803bb32c983",
      "id": "CVE-2021-34428",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-34428 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e9c829bb-476b-54ba-aae7-576c77f17f40",
      "id": "CVE-2023-36478",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-36478 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cbc12781-da3c-5dbb-9ecc-9bdab9eb2efa",
      "id": "CVE-2023-36479",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-36479 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:86176f78-02fb-523e-85b1-055c9cf6b41b",
      "id": "CVE-2023-40167",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f7858347-81ce-5776-967d-99fba88cbd6b",
      "id": "CVE-2023-41900",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-41900 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8c0b9c38-f108-5adf-bd46-992a896c378d",
      "id": "CVE-2024-22201",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22201 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a23f1076-a354-5fe3-aea5-59f95c22a493",
      "id": "CVE-2024-6762",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6762 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:778e7b1e-45fe-5ccd-a43c-5de9a40599b1",
      "id": "CVE-2024-6763",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:48dbe6d6-e7a5-545c-a41a-961e473d1b9f",
      "id": "CVE-2024-8184",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-8184 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3f19ff2c-fc88-5dfa-8299-d579c8df6d28",
      "id": "CVE-2025-11143",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c5cd1f6d-ff4e-5ac1-b218-11aa654b4a68",
      "id": "CVE-2025-5115",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-5115 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:51460da9-0316-5533-b424-142f88107bef",
      "id": "CVE-2026-10050",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-10050 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0a771c91-1dee-526d-bcfe-88b6d8f6113a",
      "id": "CVE-2026-10051",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-10051 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65396d10-3afd-5145-935d-054a1f0c45bf",
      "id": "CVE-2026-1605",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1605 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:49c942a7-9369-5a06-8f89-43cfb50c8a98",
      "id": "CVE-2026-2332",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:89d0c2c7-709f-5799-8d59-79705a3ac400",
      "id": "CVE-2026-5795",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-5795 is fixed in version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d9e68ea5-fd4e-51e1-9206-1ad43d3decc7",
      "id": "CVE-2026-6790",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-6790 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:71d75857-8b9e-5eb3-a76b-da3e1d74b86a",
      "id": "CVE-2026-8384",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack. not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7f892cd0-26d0-5c74-bd1b-8d011c54ab71",
      "id": "GHSA-58qw-p7qm-5rvh",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty.http2:http2-hpack."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.3"
    }
  ]
}