{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1b3c45b9-822c-5674-923f-b7c66eaf1189", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "websocket-api", "version": "9.2.16.v20160414-tuxcare.1", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3ac0a62a-5bc4-50b7-945d-e519a4bf19cb", "id": "CVE-2017-7656", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7656 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bf345cdd-a9a9-5d5e-96c0-1bd01686bc8f", "id": "CVE-2017-7657", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7657 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0f3cfd79-918b-53b9-aa8d-e9d18aa09a5f", "id": "CVE-2017-7658", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7658 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2017-7658. The fix was applied through the CVE-2017-7656 backport (commit 41af32dd6bd) on 2025-12-10. The same upstream patch (a285deea) fixed CVE-2017-7656, CVE-2017-7657, and CVE-2017-7658 together, as they all address HTTP Request Smuggling vulnerabilities in the HTTP parser. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2c3cb203-a426-5fae-9fb6-d672bf6fa996", "id": "CVE-2017-9735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-9735 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9cb25cb1-1ce0-5f4f-9c4b-3ea58ac568dd", "id": "CVE-2018-12536", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-12536 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:74abe0a1-477d-5b3a-9f13-565ac0af44c3", "id": "CVE-2018-12538", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c075e89a-e766-5e10-a2eb-6cdb26291943", "id": "CVE-2018-12545", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-12545 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. CVE-2018-12545 targets HTTP/2 SETTINGS frame handling in Jetty 9.3.x and 9.4.x. The target version 9.2.16.v20160414 does not implement HTTP/2 - it only supports SPDY. HTTP/2 support was introduced in Jetty 9.3.0 (April 2015), but this version is from the 9.2.x branch released April 2016. Exhaustive searches found no HTTP/2 modules, classes, or parsers. The INPUT (HTTP/2 SETTINGS frames) specified in the CVE is not received in this codebase. While SPDY has similar SETTINGS frames with an unbounded count field (jetty-spdy/spdy-core/src/main/java/org/eclipse/jetty/spdy/parser/SettingsBodyParser.java:53), this is a different protocol not covered by CVE-2018-12545." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bd5e63aa-2b50-51cc-99b8-6e11dbd8d551", "id": "CVE-2019-10241", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10241 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:779cb519-fbc2-5d15-b602-acdb8754b1e6", "id": "CVE-2019-10246", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d8cbad02-4b25-5d9f-b4a5-9747f83f2c3c", "id": "CVE-2019-10247", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:03f44147-86a5-5d19-9d71-69947fc23ac9", "id": "CVE-2019-17638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-17638 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d894c9b8-0526-519e-80a9-deebeebed558", "id": "CVE-2020-27216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-27216 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dbebee08-3241-5c58-a1d7-6cd1d46d92b7", "id": "CVE-2020-27218", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27218 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. not_affected \u2014 CVE-2020-27218 concerns GZIP request body inflation causing data leakage between multiplexed requests. Version 9.2.16.v20160414 does not contain any GZIP request body decompression functionality. Comprehensive analysis found no GZIPInputStream usage, no request Content-Encoding header handling, and no request body inflation code in any component. The GzipHandler only performs response compressi..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1e30c72-57ef-5538-8809-16b277975ad2", "id": "CVE-2021-28165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28165 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e684289a-2879-5d9d-b13e-11ee3e91b2e5", "id": "CVE-2021-28169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28169 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:772ee46f-bfe1-5704-bf89-ffdf6dd99a5d", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1086054a-aa0f-5d12-8933-e5243dd8e13e", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9542aa2d-197b-5e96-85ff-740d06ff48cd", "id": "CVE-2022-2048", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-2048 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. Jetty 9.2.16.v20160414 is not affected by CVE-2022-2048. This vulnerability is specific to the HTTP/2 server implementation's error handling in HttpChannelOverHTTP2.java, where BadMessageException handling fails to properly clean up resources. HTTP/2 support was introduced in Jetty 9.3.0, and the target version 9.2.16 predates this. The vulnerable code path (HttpChannelOverHTTP2 class with its onRequest/onPushRequest methods) does not exist in this version. Exhaustive searches confirmed zero HTTP/2 implementation files at target SHA 12a5258bab9. The Brief's INPUT (invalid HTTP/2 requests) cannot be received because there is no HTTP/2 server to process them." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9be32256-a884-5847-9ad5-33e2c1eb7557", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:273fca52-2ecf-5b31-9618-1bac0b713cbb", "id": "CVE-2023-26049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e71b6130-65d7-5b54-b356-10997f0e98f4", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6b1d4a6f-a0ec-5008-90c1-9891e38ff51b", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6336977d-b781-50ec-84db-d775b29e0bfe", "id": "CVE-2023-44487", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44487 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:adcd8652-14aa-5048-ac5c-678eeb8f893d", "id": "CVE-2024-13009", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-13009 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. Target version 9.2.16.v20160414 is not affected by CVE-2024-13009. The vulnerability exists in the HttpInput interceptor mechanism for gzip request body decompression, which was introduced in Jetty 9.4.x (October 2016) - six months AFTER this version. The target has no gzip request decompression capability and lacks the vulnerable code path entirely. CVE explicitly states affected versions are 9.4.0 to 9.4.56; target is 9.2.16 (before the affected range)." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:97d8e152-ff0e-50ba-a96e-a652a125affc", "id": "CVE-2024-6762", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6762 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository (Jetty 9.2.16.v20160414) is NOT vulnerable to CVE-2024-6762. The vulnerable classes PushSessionCacheFilter and PushCacheFilter do not exist in this version as they were introduced in Jetty 9.3.0 and later versions. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d6c509ac-7a9e-5649-ae2e-0ba72a67110f", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:25e36893-1f53-50b4-8337-6dc1753a478d", "id": "CVE-2024-8184", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository (Jetty 9.2.16.v20160414) is not vulnerable to CVE-2024-8184 because the vulnerable component ThreadLimitHandler.java does not exist in this version. ThreadLimitHandler was first introduced on 2016-09-08, approximately 5 months after the target repository's release date of 2016-04-14. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:14537b78-3daa-52ab-986a-f4f4f0495150", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:37adcc0e-cc42-5260-963c-205bac1cb13f", "id": "CVE-2025-11143", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-11143 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. Jetty version 9.2.16.v20160414 is not affected to CVE-2025-11143 according to advisories." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d7475e37-8c59-5af7-a60f-da3aa9589fb4", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9338196e-f726-52ca-9591-dde0c488336a", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. not_affected \u2014 Jetty 9.2.16.v20160414 does not implement HTTP trailer support. The CVE-2026-10051 vulnerability concerns trailer data leakage across keep-alive requests, but this version does not process trailers at all. The HttpParser has a TODO comment where trailer handling would be (line 1536), and no trailer-related fields, methods, or APIs exist in the server codebase." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9c0edebd-3029-5c4c-baa1-5bf727a36c6f", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. Version 9.2.16.v20160414 is not vulnerable. Summary: Target repository (Jetty 9.2.16.v20160414) is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.0.5, while the target is running version 9.2.16 from April 2016. Additionally, the target version does not support HTTP request decompression, which is required for the vulnerability to manifest. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3367a120-322c-5274-8cef-317a6740c364", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7a180864-2bf0-5506-a958-210bb3b602cd", "id": "CVE-2026-5795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:26a5e67e-f8c1-5472-8815-29a3e10dc801", "id": "CVE-2026-6790", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6790 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-6790 because it does not implement HTTP/2 or HTTP/3, which are the protocols subject to this vulnerability. The CVE concerns mismatched :authority pseudo-header and Host header validation in HTTP/2 and HTTP/3 request processing. Jetty 9.2.16 predates widespread HTTP/2 adoption and contains only SPDY support (which uses :host, not :authority). H..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:03e3acc3-e278-50ac-a75a-c661bbc348cf", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api. not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's URIUtil.canonicalPath() method which has a slash-tracking bug when processing semicolon path parameters. Jetty 9.2.16 has a fundamentally different architecture: its decodePath method strips everything after semicolons before normalization (URIUtil.java:289-297), preventing paths like /public;/....." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:abc64012-be1a-5b21-a7cf-c31e782984b8", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.2.16.v20160414-tuxcare.1 of org.eclipse.jetty.websocket:websocket-api." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.16.v20160414-tuxcare.1" } ] }