{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f56b177a-0b85-5526-9664-6c223804ed5d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1", "type": "library", "group": "org.eclipse.jetty", "name": "infinispan-remote", "version": "9.4.50.v20221201-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:82283ac5-aa35-5e0b-a270-7c028d9c064c", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2bcc243b-95eb-529b-9e84-4b1e522f438d", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9f47b88f-b820-5621-a400-ba31e229e405", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:757ce287-28c0-5cc0-870f-eca89911e02c", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:07711d92-9f7c-5bb6-8896-65d41f5cf946", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4e69ad2d-b1bb-5a75-bc76-ffb31d3ad031", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5afc1bb0-b86b-515b-b0bb-64d917c82104", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:25d5b31e-3656-5cad-b9bc-13785912ee79", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0efdd326-7ba4-5f6e-a8da-b6a3109c3373", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:362a1e81-0026-5787-95ff-8355f797333d", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:13585cb8-efcb-582a-9ce6-d4e4203175e4", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b13c1ed4-310b-5fe1-a46b-fbd1e097e856", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:457cf9cb-1e02-5c96-941b-9728c7e0ef59", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f85447b9-b73c-5e99-bd0e-0643a5f75498", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c5dcad88-42af-52b7-843f-e36db288257d", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:606f2290-8027-541f-9c23-421cc44dd1af", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:82726c2d-7bae-510e-a124-618095f3594d", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e40e895e-d701-5842-91d2-fd9c14f698f3", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b811c97b-42d3-5cee-a8f1-10930791e764", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cf60e4d9-8d2c-511d-86b6-2e78dbbc78e2", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3332db74-8b85-570f-8a33-3d26a9c1e511", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:15e7bb96-2acf-5f32-afaa-83b94b0f55e5", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a197bf48-29be-5f1d-8a74-54481caa84e2", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9a7f47aa-45c6-5c0c-bee8-dd2557d9aeee", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:96a8d7fc-db76-5082-99e2-d20fb119ef5d", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c1643728-1b4a-5a8c-9cff-f4ab6c97e07e", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f7589bcf-4f6f-5ea2-8fab-079246e95a31", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.1 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.50.v20221201-tuxcare.1" } ] }