{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:881d2296-87b5-5209-998b-97028554d086", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.osgi", "name": "jetty-osgi-alpn", "version": "9.4.48.v20220622-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0fd6a625-5685-5d76-9da5-1e4176958766", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:84c7f084-5607-5438-bb44-3e3063879c3b", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1fd2611b-458d-53b4-bdff-011b9612b2ab", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:01754cac-5879-57c3-a38c-0005c46f67d5", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bf9828f2-28e8-57d6-abbc-19702b987948", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:365609a6-a7f4-5cb3-bd95-6dbdba516085", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:26b06c0e-f188-54d6-bc61-97bf64928885", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f7c018a9-8acc-5852-8ebc-a87165db7738", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2434ea30-5459-56f7-a1cc-f1d287448b56", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a90a3591-2bf6-5d45-ba9e-7d5a6458b3a0", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ec3e9001-5461-5e3c-b662-dd600de77eea", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c2939ba1-4297-5963-9588-fc6f6c1ac574", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:af847f4c-4499-5c12-8cd6-16fcd03f6c47", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:05afb61e-5f98-5323-ba8f-6e978641a528", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:74c545ac-3cf3-5602-ad3e-fd5e668df542", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a2c808de-2588-54bb-ba34-5fa52e38616c", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:94758304-fd6f-5ce4-a367-e96a1a790b6c", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:733386c7-654f-549a-9317-f67da8390c8f", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4b1ca159-8f79-503c-b381-bddc7528c191", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fdd8fd8e-2051-550e-b58c-c0cf9370f8c8", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b3439508-dd20-503b-a94f-afe5b3b76a5a", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0090f766-dcc8-59c5-94d8-d0a0522392d5", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:11c0e384-4526-59ad-89b5-1f787e971d24", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:764a1af7-3d86-5abc-b410-a40bd8ef2262", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b733f5e4-d92e-5447-9500-29faff426beb", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e917ff04-c5c8-54bf-89e1-b8945c9afd5c", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.osgi:jetty-osgi-alpn." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-alpn@9.4.48.v20220622-tuxcare.2" } ] }