{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ffeec19e-8076-546e-890c-b9b51b745a4d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.tests", "name": "test-sessions-common", "version": "9.2.16.v20160414-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0bf381b2-d5a0-5546-a5b2-3c534e0509b8", "id": "CVE-2017-7656", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7656 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:564d2d6f-33b9-50bb-b643-ea4def8c26c4", "id": "CVE-2017-7657", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7657 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4486dcae-5cab-5e0c-a001-4320851d24c6", "id": "CVE-2017-7658", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7658 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2017-7658. The fix was applied through the CVE-2017-7656 backport (commit 41af32dd6bd) on 2025-12-10. The same upstream patch (a285deea) fixed CVE-2017-7656, CVE-2017-7657, and CVE-2017-7658 together, as they all address HTTP Request Smuggling vulnerabilities in the HTTP parser. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f8c687bf-c216-5a90-852f-667836e43d75", "id": "CVE-2017-9735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-9735 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:622824ea-90df-5a79-8a1b-bfc108e87342", "id": "CVE-2018-12536", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-12536 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e8c1259c-b3ec-58a6-83db-572a2dee9db7", "id": "CVE-2018-12538", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2e87de47-5b21-5909-af78-fba014b9a938", "id": "CVE-2018-12545", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f80bf1e5-d3d3-5f8a-b159-50820b82c2c3", "id": "CVE-2019-10241", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10241 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e902dc99-8a16-5840-b7b8-bb03ad49e7ee", "id": "CVE-2019-10246", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4a0da452-3ac3-5c42-bf43-5f7c252788b9", "id": "CVE-2019-10247", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:458ef15a-2b01-5aa5-8073-c489d5f1288b", "id": "CVE-2019-17638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-17638 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5a5ef524-6378-5e60-b1d2-5c0a84bc8dd5", "id": "CVE-2020-27216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-27216 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6c3c939e-702f-5c38-b31b-f2af27dd3a91", "id": "CVE-2020-27218", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4b170095-b7eb-5f72-98f8-d05b0c02c9e0", "id": "CVE-2021-28165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28165 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0da58c40-70cc-58f6-9f61-e6aba0efb037", "id": "CVE-2021-28169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28169 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:841d1931-24e5-50fc-a08e-4804ef08addc", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:444a25af-ab24-57bf-aa97-819fb4d92638", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:51939c4c-efff-57ad-9d33-31092b8a5bf2", "id": "CVE-2022-2048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f5be3c3b-1c90-599e-8db2-cca4dfcf9393", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:180670fb-a782-5116-aba0-c490d227d7fc", "id": "CVE-2023-26049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:41929786-0651-501f-b7d9-463d684b6b78", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6877637f-17e8-5634-9ff7-e6094bef2f73", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8ec17c11-e4a8-5644-911c-5b009c2aefb1", "id": "CVE-2023-44487", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44487 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a71ca5af-62b0-5b0a-bf9f-511397482a78", "id": "CVE-2024-13009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:debc8671-f380-5f41-ae01-e09c5186ef29", "id": "CVE-2024-6762", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6762 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository (Jetty 9.2.16.v20160414) is NOT vulnerable to CVE-2024-6762. The vulnerable classes PushSessionCacheFilter and PushCacheFilter do not exist in this version as they were introduced in Jetty 9.3.0 and later versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bd30292d-1433-5f3b-b980-e2a8a0b4f1f3", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:90786053-4193-542f-a276-5c7cefd90afe", "id": "CVE-2024-8184", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository (Jetty 9.2.16.v20160414) is not vulnerable to CVE-2024-8184 because the vulnerable component ThreadLimitHandler.java does not exist in this version. ThreadLimitHandler was first introduced on 2016-09-08, approximately 5 months after the target repository's release date of 2016-04-14. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:acbc24c6-d787-5b17-a644-00f42a16cfbb", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:30f0efba-9e6a-5e43-90f8-b414347c9213", "id": "CVE-2025-11143", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-11143 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common. Jetty version 9.2.16.v20160414 is not affected to CVE-2025-11143 according to advisories." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cf597e54-5683-5c04-82a0-5345d3500506", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8fc1c86e-b800-5492-9163-8214be9269cb", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common. not_affected \u2014 Jetty 9.2.16.v20160414 does not implement HTTP trailer support. The CVE-2026-10051 vulnerability concerns trailer data leakage across keep-alive requests, but this version does not process trailers at all. The HttpParser has a TODO comment where trailer handling would be (line 1536), and no trailer-related fields, methods, or APIs exist in the server codebase." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:287c4d29-2070-5dbd-a6fc-6ded92aaf171", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common. Version 9.2.16.v20160414 is not vulnerable. Summary: Target repository (Jetty 9.2.16.v20160414) is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.0.5, while the target is running version 9.2.16 from April 2016. Additionally, the target version does not support HTTP request decompression, which is required for the vulnerability to manifest. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5c14f13e-276e-5efd-bd9a-3f73b8910ed8", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:29e0ff41-aeb7-5d2e-9403-78971ab20043", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:df3c7819-1b0b-5999-8de0-3cb8dc06bcd3", "id": "CVE-2026-6790", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6790 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common. not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-6790 because it does not implement HTTP/2 or HTTP/3, which are the protocols subject to this vulnerability. The CVE concerns mismatched :authority pseudo-header and Host header validation in HTTP/2 and HTTP/3 request processing. Jetty 9.2.16 predates widespread HTTP/2 adoption and contains only SPDY support (which uses :host, not :authority). H..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9f572fb3-5db0-5f1b-a2e1-b3ae73cfa88f", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common. not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's URIUtil.canonicalPath() method which has a slash-tracking bug when processing semicolon path parameters. Jetty 9.2.16 has a fundamentally different architecture: its decodePath method strips everything after semicolons before normalization (URIUtil.java:289-297), preventing paths like /public;/....." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e70d7d43-2c87-501e-b841-1937a70a8a69", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.tests:test-sessions-common." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.tests/test-sessions-common@9.2.16.v20160414-tuxcare.1" } ] }