{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:71575718-b2d7-56aa-9541-c676d24e3eab", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "javax-websocket-server-impl", "version": "9.4.50.v20221201-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:46943e15-a2b9-526a-aeb5-c9825ab4ec3a", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8761e837-92d4-5e0e-9a34-42e6bf6d54f5", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:abcc0930-f067-5630-91ad-5327024faf87", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ec6d9103-e257-539c-bc94-72044f0e159d", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ecb75967-92f0-523d-ae4f-aa1771e84364", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:79d26232-1c2d-52be-b06a-a52aee013e24", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3cc7f3cd-33bb-5f0b-996d-2fc2af0cb0fd", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bbccf27f-435f-5e77-8d4d-92bcf24581d0", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:83dd57d7-2b48-58b5-a423-6a0783afeb88", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5fbeb29c-38bd-5206-9046-651c48939a74", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c2e1eabe-20e0-5630-baed-181d4efe2ede", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0e4a54cb-0849-5ac1-8b29-fc92bbe4c0be", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1489a5be-e281-5e76-acfc-a688aaa003ac", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c2011fb7-7bcb-5f2c-9396-50b97a593070", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:84711555-11ef-51c4-a57f-f64a9863c829", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0a8a9bca-fe69-5b9d-b83f-d1f1b490a3eb", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1d21901e-d08b-50a2-b148-30af05deca71", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:685e7ba5-fa5f-569c-b888-0f7f1de3ebf8", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:327ebdd5-2c27-5b71-b35c-8f2b1ed7d8fa", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:139daa52-734a-519e-8f82-5f4a1fd6dfab", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2f8dd2bc-033f-5eee-ba29-977b8b9a9b15", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f825a3ab-b2b4-5050-84ed-f405ed4506ea", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:46d8f80d-4e2e-5826-b701-dfd71fc3c738", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b41809e2-6c70-5184-980d-2d053774ffa6", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c01f636e-404a-5b18-9558-53c81193b149", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1848e795-2dc7-5f62-904e-eff626672b44", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4d837e1f-56b6-5577-a4ca-61df11d3b9ba", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.websocket:javax-websocket-server-impl." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-server-impl@9.4.50.v20221201-tuxcare.2" } ] }