{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7ee18d8b-c192-5bc1-a3bc-63340fde6f52", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "websocket-jetty-client", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1", "version": "11.0.18-tuxcare.1", "pedigree": { "ancestors": [ { "name": "websocket-jetty-client", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18", "type": "library", "group": "org.eclipse.jetty.websocket", "version": "11.0.18" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:4e682a0f-6948-5b6c-b63a-3605cbed56f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:f1f5f5bc-d761-5747-a4cf-9849a5b11a76", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6762 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client. not_affected \u2014 Target version 11.0.18 already contains the upstream vendor's fix for CVE-2024-6762. Both PushSessionCacheFilter and PushCacheFilter are deprecated with warnings that they are \"example class not suitable for production.\" This deprecation was added by upstream Jetty developers (Lachlan Roberts, lachlan@webtide.com) in May-October 2023 and was included in the upstream Jetty 11.0.18 release before...", "justification": "code_not_present" } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:9692c91c-369f-5e0d-bbce-90b48ce9723b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:a031cfcc-64a1-5bc6-918d-9ee9ed5a66e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:e0fb0a44-9161-5958-b300-04ee6fdc8a49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:6d41c4ca-5838-5090-8af3-33b0c615ccf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:15627fde-3b07-5fa2-bd8c-1e56b8f4db8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:e0ae5cb9-4bcc-5191-8520-0eb90ff46075", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:d40d7c46-6f89-57e9-a032-3606e3aaf4f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:d57c68a7-13f9-5029-9bec-a11fa1200fef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client. Jetty 11.0.18 is not affected by CVE-2026-1605. The vulnerability exists in Jetty 12.0.30 due to a specific architectural pattern where GzipRequest.destroy() is not called when only request inflation occurs (no response deflation). Jetty 11 uses a fundamentally different architecture: GzipHttpInputInterceptor handles inflation independently, and its lifecycle is managed by the HttpInput recycling mechanism which ensures destroy() is always called when request processing completes, regardless of whether response deflation occurs. The input and output handling are architecturally separate in Jetty 11, eliminating the conditional logic flaw that causes the leak in Jetty 12.", "justification": "code_not_present" } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:882ed819-df0d-53a8-8e4a-6c827baab708", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:3dee28d8-97bc-593d-bdc4-6429a283d7d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:044a9464-297a-5031-83f7-7b70cbe6cb31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:a21b5585-406b-5b5b-9d40-c9f106777662", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:32c6cfae-b51f-5b02-83b1-b90ee39fb36e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:51799109-9550-5a61-8480-f5204526e427", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:a2ba81f8-87ce-5d56-b102-3d65921965c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:b84b3703-f6a9-55f1-a48d-198ada885dd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:ad55d7c1-0faa-534f-b7c6-962c04480c31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client. not_affected \u2014 Jetty 11.0.18 is NOT AFFECTED by CVE-2026-8384. The vulnerability is specific to Jetty 12's refactored architecture where URIUtil.canonicalPath() was redesigned to handle encoding, semicolon path parameters, and dot normalization in a single method. Jetty 11 uses a fundamentally different two-method approach: decodePath() strips semicolons first, then canonicalPath() normalizes dots separately....", "justification": "code_not_reachable" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:9af8ca9b-ab03-5078-bace-a43dcc75bf40", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.websocket:websocket-jetty-client. not_affected \u2014 GHSA-58qw-p7qm-5rvh concerns Jetty's XmlParser being XXE-capable. The advisory is explicitly informational (\"not considered a vulnerability of the Jetty server itself... No CVE will be allocated\"); the named remediation is PR #10067, which adds the ability to configure the SAXParserFactory (an overridable newSAXParserFactory() hook + getSAXParser() accessor), NOT XXE-hardening-by-default. The target (Jetty 11.0.18, SHA a459f013996) ALREADY contains PR #10067: commit 9a05c75ad28 is an ancestor of HEAD and of the jetty-11.0.18 tag. XmlParser.java uses newSAXParserFactory() in the constructor (line 69) and setValidating() (line 95), defines the hook (lines 86-89), exposes getSAXParser() (lines 137-140), and its resolveEntity() (lines 264-300) has the restricted \"only serve entity if found\" logic. The target matches the post-fix pattern exactly, not the pre-fix pattern (hardcoded SAXParserFactory.newInstance() with no hook). The fix is upstream-authored (Joakim Erdfelt), present in the release base before any TuxCare commit. TuxCare backported the SAME changes to older 9.x lines (9.2.16/9.4.41/9.4.48/9.4.50) precisely because those lacked the upstream fix; 11.0.18 needed no backport because upstream already shipped it. Verdict: not_affected (upstream fix present in shipped version). [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-client@11.0.18-tuxcare.1" } ] }