{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:04a566b9-3190-509b-9848-55d729817356", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty", "purl": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001", "type": "library", "group": "org.eclipse.jetty.documentation", "bom-ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001", "version": "10.0.31.tuxcare0001", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:c807e8b9-dd19-563f-8723-b92e6fa2c75b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27216 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. Version 10.0.29 is not vulnerable. Summary: CVE-2020-27216 has been fixed in this repository. The target is running Jetty 10.0.29, which is well after the affected version range (10.0.0.alpha1 through 10.0.0.beta2). The vulnerable temporary directory creation pattern using File.createTempFile() followed by delete() and mkdirs() has been replaced with the secure Files.createTempDirectory() method, which provides atomic creation with restrictive permissions (0700 on Unix). [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:32a2ee81-987d-509b-8b0c-e6c64d1732c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-28169 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. Version 10.0.28 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The fix was applied in Jetty version 9.4.41/10.0.3/11.0.3 (May 2021), and the target is running version 10.0.28 (March 2026). The double encoding vulnerability in ConcatServlet has been mitigated. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:f9dcdb55-aac3-5e0c-b332-7cbbd2a903a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. not_affected \u2014 The target repository (jetty-project 10.0.31) contains the upstream vendor fix for CVE-2021-34428. The vulnerability pattern has been removed by commit 087f486b446 authored by Jan Bartel from the Eclipse Jetty project. The fix ensures session IDs are invalidated even when SessionListener#sessionDestroyed() throws exceptions by moving the invalidateAll() call into a finally block. This is not a ...", "justification": "code_not_present" } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:7420c6dc-8e50-5d56-a2b3-bd4d00f693d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36478 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. CVE-2023-36478 is not present in Jetty 10.0.31. The vulnerable integer overflow in MetaDataBuilder.checkSize was removed from the 10.0.x line by the HPACK/QPACK rework of Jetty issue 9554 (pull request 9634), first shipped in Jetty 10.0.16; the method no longer exists in jetty-http2/http2-hpack, and MetaDataBuilder.emit accounts header size as name plus value length with no multiplication. String literal lengths are decoded by NBitIntegerDecoder using Math.addExact, Math.multiplyExact and Math.toIntExact, so an oversized encoded length throws rather than wrapping negative. HuffmanDecoder builds its output into a dynamically grown Iso88591StringBuilder and never preallocates from the declared length, and HpackDecoder.decode rejects a header block larger than the configured maximum before decoding begins. The large buffer allocation the advisory describes therefore cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:505ef022-d106-59f8-8758-26c1df0435cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:6a673f7e-b563-5fcc-8f8c-19f67b9e60b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-40167 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. Version 10.0.28 is not vulnerable. Summary: The target repository has the fix for CVE-2023-40167 applied. The Content-Length parsing code in HttpParser.java uses strict digit-only validation that rejects '+' prefix, preventing HTTP request smuggling attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:ed97206d-4648-5f56-9d65-478fe74eff35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41900 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. Version 10.0.28 is not vulnerable. Summary: The target repository (Jetty 10.0.28) is NOT vulnerable to CVE-2023-41900. The security fix has been properly applied. The vulnerable code that only called session.removeAttribute() has been replaced with logoutWithoutRedirect() which properly invokes super.logout() to clear all authentication state. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:867162a4-05a9-520e-88a0-4ab92ec82ec1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22201 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. CVE-2024-22201 is not present in target Jetty 10.0.31. The vulnerability (HTTP/2 idle timeout failure to close TCP-congested connections) was fixed by upstream vendor in commit b953871c9a5ff4fbca4a2499848f75182dbd9810, included in Jetty 10.0.20 release (January 2024). Target version 10.0.31 contains this fix. The vulnerable code pattern (early return without calling terminate()) has been replaced with logic that force-terminates the connection even when the session is marked closed, preventing file descriptor exhaustion.", "justification": "code_not_present" } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:091f7057-69e6-5210-bb1d-1f0653756dd9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6762 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. not_affected \u2014 CVE-2024-6762: The upstream Jetty vendor applied a deprecation-based fix (commit ce80bf46d4f by lachlan@webtide.com) marking PushSessionCacheFilter as unsuitable for production. This fix is present in target version 10.0.30.tuxcare0002. Per Rule 3, the vendor's chosen mitigation strategy (deprecation + warning) is authoritative. Since the fix was authored by upstream (not TuxCare), verdict is n...", "justification": "code_not_present" } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:3cae40bc-6fc8-5a64-886a-0215f69ab74d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:5e484942-2aad-5a4c-923f-692d20927e84", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:9f71359a-0c02-556a-9290-f3b42d5468b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:a0c6e470-bcc9-5d96-ac14-90bf5ac184ef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:bbd9e457-c8d7-55d9-b2dc-66b5979d007e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:e4917538-87c6-5e41-8dc8-d4e37e327cd3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. not_affected \u2014 CVE-2026-10051 describes a trailer leak vulnerability in Jetty 12.x where connection-scoped _trailers field is never reset between HTTP/1.1 keep-alive requests. The target (Jetty 10.0.31) uses a different architecture where _trailers resides in HttpChannelOverHttp and is properly reset via recycle() method, which is called between every request. This defensive code has been present since traile...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:1957e0dc-6222-54d0-9290-0540fa920022", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:d5e7a6ba-8fc3-5482-b13a-28cf478d8317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:1ed1383d-9219-54af-8f68-f6c9624684b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:8c8fb5c8-a26f-52fd-bc6b-c24da39b5591", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:1528fa73-adae-524a-88a4-079492ac65fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. not_affected \u2014 Jetty 10.0.31 is NOT affected by CVE-2026-8384. The vulnerability requires specific code in Jetty 12's refactored architecture where canonicalPath() gained semicolon stripping with broken slash tracking. Jetty 10's canonicalPath() lacks the vulnerable case ';': handler entirely (lines 928-1010), treating semicolons as regular characters. The '/' after ';' correctly sets slash=true, enabling pro...", "justification": "code_not_reachable" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ], "bom-ref": "urn:uuid:7b8234b3-bd46-5584-9c93-46954d819236", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.documentation:jetty. not_affected \u2014 Target contains the upstream vendor fix for GHSA-58qw-p7qm-5rvh. The XmlParser class includes the newSAXParserFactory() override mechanism (lines 86-89) and getSAXParser() accessor (lines 137-140) introduced by upstream commit 9a05c75ad28 in Jetty 10.0.16. This fix, authored by joakim.erdfelt@gmail.com, predates version 10.0.31. The vulnerable pattern (inability to configure secure SAX features...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/jetty@10.0.31.tuxcare0001" } ] }