{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:19a94e9a-c512-520c-b36a-1bb973b3a509", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "memcached-parent", "purl": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001", "type": "library", "group": "org.eclipse.jetty.memcached", "bom-ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001", "version": "9.4.63.tuxcare0001", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:f1ca9fbe-032e-5d44-bbcf-d5da6119ef6f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27216 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. Jetty 9.4.63 does not contain the vulnerable temporary directory creation pattern (File.createTempFile + delete + mkdir race condition) that CVE-2020-27216 describes; it is absent from the codebase. In jetty-webapp, WebInfConfiguration.makeTempDirectory and cloneConfigure both create the webapp temporary directory with java.nio.file.Files.createTempDirectory, which creates it atomically with owner-only permissions and leaves no window for a local user on a shared /tmp to hijack the directory into which the war and its WEB-INF/lib jars are unpacked. The fix was applied by the upstream Jetty vendor in 9.4.33.v20201020 (October 2020), and this version inherits it from upstream.", "justification": "code_not_present" } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:c4d09d67-289f-5ed9-b7e1-a09e9cdc822c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-28169 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. Version 9.4.60 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The ConcatServlet now properly validates paths before dispatching, preventing double-encoded path traversal attacks to access WEB-INF/META-INF protected resources. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:13f4363d-9f46-522e-b8a7-88b714ab7b22", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. not_affected \u2014 CVE-2021-34428 is not present in target version 9.4.63. The upstream Jetty project fixed this session invalidation vulnerability in version 9.4.41.v20210516 (commit 087f486b by Jan Bartel on 2021-05-16). The fix wraps SessionListener.sessionDestroyed() calls in try-catch and moves session ID invalidation (invalidateAll) into a finally block, ensuring sessions are properly invalidated even when ...", "justification": "code_not_present" } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:36d786e1-055b-52db-a086-ce7725b1adba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36478 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. Version 9.4.59 is not vulnerable. Summary: The target repository has all security fixes from CVE-2023-36478 already applied. The repository is NOT vulnerable to the integer overflow attack in HTTP/2 HPACK header processing. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:efcaa2f6-3788-5f45-9226-0d4f18ce4e11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36479 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. not_affected \u2014 The upstream vendor (Eclipse Jetty) applied their chosen mitigation for CVE-2023-36479 by deprecating the entire CGI servlet class in commit ec7e1fd173 (June 2023). While the vulnerable escaping code remains present at lines 350-351, the vendor's official position is \"do not use, no replacement, will be removed in a future release.\" The @Deprecated annotation and removal from test configuration...", "justification": "code_not_present" } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:7740e491-cb5d-5d00-a391-a1cefaf44b09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-40167 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. not_affected \u2014 CVE-2023-40167 is NOT present in the target. The upstream vendor fix (Eclipse Jetty commit e4d596eafc887bcd813ae6e28295b5ce327def47 from 2023-08-21) is already in HEAD's ancestry. The vulnerable code pattern (using Long.parseLong() which accepts '+' prefix) has been replaced with strict character-by-character validation that only accepts digits '0'-'9'. This is an upstream vendor fix, not a Tux...", "justification": "code_not_present" } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:9ceaeda4-3844-558c-b686-5ce917581be3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:f5066ead-d117-569c-b9ac-5a0f84a3f83a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22201 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. CVE-2024-22201 is not a vulnerability in version 9.4.63. The fix is already present in the code at jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Session.java lines 1888-1906, having been applied by upstream Eclipse Jetty in commit 86586df0a8a4d9c6b5af9a621ad1adf1b494d39b and first released in 9.4.54, from which 9.4.63 descends. The vulnerable pattern (returning false on the second idle timeout when the session is already closed, leaving TCP-congested connections in ESTABLISHED state until file descriptors are exhausted) has been removed: the already-closed branch of onIdleTimeout() now sets terminate = true and falls through to terminate(goAwayFrame), which closes the underlying connection. The HTTP/3 and QUIC code that the same upstream change also touched does not exist in the 9.4.x line.", "justification": "code_not_present" } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:334483fd-297f-53f9-9a69-52a45e29bea1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6762 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. not_affected \u2014 CVE-2024-6762 affects Jetty's PushSessionCacheFilter and PushCacheFilter due to unbounded cache growth leading to memory exhaustion. The target repository (Jetty 9.4.63, commit 7267af07102) contains the upstream vendor's fix, which deprecates both filters and adds explicit warnings that they are \"example class not suitable for production.\" The fix was authored by upstream Jetty developer Lachla...", "justification": "code_not_present" } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:779a32eb-87ae-5d93-8a87-994a0098dcac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:ffc28e7f-d428-56c3-b30b-026aecb08431", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:556f7287-6668-59ed-a4fb-694050c3b7ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:5cdb5edb-e4ff-5adb-9ca6-5f92a96d39b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. CVE-2025-5115 (MadeYouReset) is NOT present in Jetty 9.4.63. The vulnerability's rate-limiting fix was already included in the upstream Jetty 9.4.63 release (commit 2daf58d2560 by Simone Bordet, August 2025). All three mitigation components are present and functional: (1) rate control on server-sent RST_STREAM frames, (2) rate control on WINDOW_UPDATE frames received for closed streams, and (3) rate control on invalid WINDOW_UPDATE frames with delta=0. The rate limit is configured to 128 events/second.", "justification": "code_not_present" } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:136d9e23-d67e-51c3-9548-295034e776f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:09159887-b7e3-5b4e-a3bd-1d88a91a32c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. not_affected \u2014 Jetty 9.4.63 is not affected by CVE-2026-10051. The vulnerability exists in Jetty 12+ where HttpConnection._trailers is never reset between requests on persistent connections. Jetty 9.4.x has a fundamentally different architecture: trailers are stored in HttpChannelOverHttp and HttpChannel (not HttpConnection), and both fields are properly cleared via recycle() methods called after each request...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:032eb238-e5a0-582f-b4ac-5c8cb17dd9a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:4657a65b-16ce-501a-a689-72389565fffc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:afef3f17-a65c-5ac7-b4f9-909e6e5c7718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:5ae1271e-5b01-5a10-bdbc-fa3345bd2810", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:adeedb11-f614-53b8-bde5-aaab661f0e65", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. not_affected \u2014 Jetty 9.4.63 is NOT AFFECTED by CVE-2026-8384. The vulnerability exists in Jetty 12.x's new unified canonicalPath implementation that combines percent-decoding, semicolon stripping, and dot-normalization in a single pass with slash-state tracking. Jetty 9.4.x uses a fundamentally different architecture: separate decodePath (strips semicolons) and canonicalPath (normalizes dots) called in sequen...", "justification": "code_not_reachable" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ], "bom-ref": "urn:uuid:102fb0a4-4248-5fbd-bc99-3dc9cdf945d2", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.memcached:memcached-parent. not_affected \u2014 The target contains the upstream vendor fix (commit d4d8832b11f) that addresses GHSA-58qw-p7qm-5rvh by adding customization hooks (newSAXParserFactory(), getSAXParser()) to XmlParser. The vendor explicitly defines the fix as \"Ability to configure the SAXParserFactory\" rather than enforcing default XXE protections. The vulnerable pattern (inability to customize SAXParserFactory) is not present i...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/memcached-parent@9.4.63.tuxcare0001" } ] }