{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b6fe3da2-4aff-5caf-b9aa-038bebe9b559", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "websocket-server", "version": "9.4.50.v20221201-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:4b6b6ec3-17d4-5aea-a02d-b2eb081da737", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:28b74863-a739-5035-b6e3-34ddfe8ebda0", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:de5d7954-ea74-504f-ad5a-ec61f995ae96", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:16618c85-c1ae-5001-b19b-39698ff760f6", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5c9fbbc7-ca3c-5b0e-9ad5-31f7099ded32", "id": "CVE-2023-26048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c4f93f4a-7c32-501e-9d69-c5ee51819c2d", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:73c94d35-9896-5371-9984-fdede2c538d5", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3dd66c7f-4751-513d-87d2-184887fdfb1b", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cd18c794-c18a-5912-85ae-4f4fa01473ec", "id": "CVE-2023-40167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6f9120b3-1590-5a7f-b0d6-b5ea980470ff", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b3d0070d-bc8d-55b7-95cf-d243ef56a8e5", "id": "CVE-2023-44487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:56b31492-d9d9-5e95-804f-73ed57e53d89", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1d84a288-7a27-568c-aed2-adfdd25dc427", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9a643644-6cb9-57ae-93de-33b50cb07787", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2a5fd723-bca1-5581-9066-feda8c5b6c96", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fd538d5f-ce0f-5e50-988e-de983a8e4567", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c3e91252-820a-549d-a832-13a415bb8b1b", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2be446ee-925e-5bd1-b182-b597812b0d6d", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:265a026a-86a6-56ed-b452-e3f453c84bab", "id": "CVE-2025-5115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-5115 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aedf2c91-68de-5e86-8420-c570861b569b", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a594a7b1-ac3c-5de5-b262-7ebab309a1bc", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:da9389c5-6f54-5210-b19a-b40003ba6282", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:714a9e68-6bbd-57c3-9eaf-8b57c692edaf", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e3fb7476-893d-5526-b396-b734fd94addc", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:41289b5c-e20e-5f05-86a9-17207182d491", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:be8834ba-a8a8-5f72-b8b4-9d53df55bb9a", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7c026bda-cc7f-5b04-a2f8-7c92c0fb6758", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.50.v20221201-tuxcare.3 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.50.v20221201-tuxcare.3" } ] }