{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:970f55ce-1e26-5e17-b716-77afc025a25c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-bom", "version": "11.0.26-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:537e8257-bf1d-5fa4-9666-14382770a659", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:24ae1f8b-c606-593c-95f4-e3d5ae47df58", "id": "CVE-2024-22201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:793cbbfb-7f53-515b-8e4a-761a790c1b04", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f5b9310f-d4f2-5306-951b-1db9c3910f24", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee386110-a49c-5208-a0ae-a6377a12fff8", "id": "CVE-2024-8184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:250b4aa6-1625-567b-87db-19f6a040342d", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:69f94d28-d3ed-5592-8291-9eff332e5d97", "id": "CVE-2025-5115", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom. Version 11.0.26 is not vulnerable. Summary: CVE-2025-5115 (MadeYouReset) vulnerability patterns exist in the codebase (HTTP/2 WINDOW_UPDATE with delta==0, window overflow, and DATA frames on half-closed streams all trigger RST_STREAM from server), BUT the mitigation has been applied via commit a05e1d031d0 which implements rate control on server-sent RST_STREAM frames (default 128/second limit), preventing the DoS attack. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c4b3f6b9-a51b-5e6d-8d98-4694f476a0cf", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9495d841-f6b1-5eb1-af82-7a24c4dc073e", "id": "CVE-2026-10051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2f6aea32-0d19-5e2e-aae5-e4dacf5e88d1", "id": "CVE-2026-1605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1ca14aff-b679-559f-8964-005334666099", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:90f98a13-f8a9-5fc9-9bc8-89b554bbe6ad", "id": "CVE-2026-5795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:751844fc-a3b4-562c-9c97-18e96cdcb862", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6f078e50-4a35-5bf5-b56f-f48a4d9b6207", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom. not_affected \u2014 Jetty 11.0.26 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12 where URIUtil.canonicalPath() integrates semicolon path parameter handling with dot-segment normalization and contains a slash state tracking bug. Jetty 11 uses a different architecture with separate decodePath() and canonicalPath() methods that correctly normalize paths containing semicolons." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5f0e4b13-351d-50bf-bacc-3d55fe9de6a0", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.26-tuxcare.1 of org.eclipse.jetty:jetty-bom." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-bom@11.0.26-tuxcare.1" } ] }