{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:89e0ad5f-29d3-5b9f-82a2-ffb3c90de47f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.http3", "name": "http3-common", "version": "11.0.19-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:904ee20f-d212-512c-8b23-d89b5c700b92", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2735d4f7-658b-5d21-ab2d-0cd8970878c2", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:321add29-ccc4-57eb-8e58-c35c7c2c84c3", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:045d51c7-15b2-540a-9da0-8048bcb3acfa", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3b4f5f4b-57bf-5d2b-8623-85796932c1ab", "id": "CVE-2024-7708", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9eea033c-12ed-51a0-ae0f-49f5291e3cbc", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a2d2cc43-dee8-5b1f-8404-15cac8b85452", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c31b868a-0993-5324-a6f0-e07ad158b443", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dd56594d-5840-5f66-bf40-a14b4069d6e9", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b190c1b0-027e-51cf-bd5b-faf509b95629", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-10051 (HTTP trailer cross-request leakage). The target version has a fundamentally different architecture from the vulnerable Jetty 12. In Jetty 11, the `_trailers` field is managed in `HttpChannelOverHttp.java` and is reliably reset to null in the `recycle()` method, which is called after each HTTP request completes. This architectural defense prevents..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9abbd87d-d80e-5f60-889f-da1288582429", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common. Version 11.0.19 is not vulnerable. Summary: Target repository is Jetty 11.0.19, which is not affected by CVE-2026-1605. This CVE specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.1.5). Jetty 11 uses a fundamentally different architecture where request decompression resource cleanup is properly tied to the request lifecycle via HttpInput.recycle(), not to response compression status. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cfdd93dc-881a-520f-ab02-f516812670ac", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a1a57cf3-0832-52d8-804a-e31d395dbb8f", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e433a0bd-0522-51db-ac2b-a697dd59a915", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:68a45598-f6ab-560b-a3a7-5ed2472cbd08", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.x due to architectural changes where canonicalPath() processes encoded paths directly with semicolon handling. Version 11.x uses a two-step process (decodePath then canonicalPath) that correctly normalizes paths like /public;/../admin/secret to /admin/secret, preventing security constraint bypass." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7d139be8-2e78-5f1f-86da-1bb128245943", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.19-tuxcare.1 of org.eclipse.jetty.http3:http3-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.http3/http3-common@11.0.19-tuxcare.1" } ] }