{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d734ea3f-bc91-50cf-9341-94ff9281abe0",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3",
      "type": "library",
      "group": "org.eclipse.jetty",
      "name": "jetty-quickstart",
      "version": "9.4.58.v20250814-tuxcare.3",
      "purl": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:c4d03039-b7ac-56c8-b943-250547d3690c",
      "id": "CVE-2020-27216",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27216 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:870e1a9a-a869-5215-a626-67cadce1c17f",
      "id": "CVE-2021-28169",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-28169 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a35bc435-d49c-5406-af4a-98174408fb1a",
      "id": "CVE-2021-34428",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-34428 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d79fa814-c9a8-51cf-87d2-a1b53d3159ef",
      "id": "CVE-2023-36478",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-36478 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ecce290e-cc09-5707-b177-4ceb5a5b4d85",
      "id": "CVE-2023-36479",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-36479 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8eaa8444-9b09-5abb-a793-3dcaad92499b",
      "id": "CVE-2023-40167",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c8dc7f6e-7131-5d8e-abd3-81174adf5344",
      "id": "CVE-2023-41900",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-41900 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:93342955-f46a-56cf-9c12-ad464289e4c4",
      "id": "CVE-2024-22201",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22201 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bbaad0af-8e7a-5516-bb73-b57983b8dc3d",
      "id": "CVE-2024-6762",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6762 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ef3b310b-040b-55d1-8398-94bc49f405e7",
      "id": "CVE-2024-6763",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4e1ec1f8-8cee-57fa-bc08-55771c5b1c77",
      "id": "CVE-2024-8184",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-8184 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:326cfafd-234a-5128-80be-753ff90b9ac0",
      "id": "CVE-2025-11143",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d3b8bf78-0b4e-55d7-bb13-9bfd635e9f21",
      "id": "CVE-2025-5115",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-5115 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9e16c2ec-f550-5fc5-86b5-632788a65bfd",
      "id": "CVE-2026-10050",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-10050 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:51be31a3-0b11-5faf-98e8-fbb15676666e",
      "id": "CVE-2026-10051",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-10051 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6e7e8cc6-a38b-5c46-8759-3328c5b8aaa6",
      "id": "CVE-2026-1605",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1605 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2577a3c3-cf9e-5df5-93df-91d0ac40acc0",
      "id": "CVE-2026-2332",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:eb633bd5-1fcf-57a0-9749-8a66b9e7f54e",
      "id": "CVE-2026-5795",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-5795 is fixed in version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f2f36076-bfba-5d0d-ba41-cb66144f7059",
      "id": "CVE-2026-6790",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-6790 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a7cd96e0-fff2-52bc-95d1-5e5f7454bb1b",
      "id": "CVE-2026-8384",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart. not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c1674542-42cd-591c-8ea2-10a5d6fd939d",
      "id": "GHSA-58qw-p7qm-5rvh",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:jetty-quickstart."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.eclipse.jetty/jetty-quickstart@9.4.58.v20250814-tuxcare.3"
    }
  ]
}