{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:66b6b4bf-fea4-5c1d-b6ce-05f720ce6105", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "websocket-servlet", "version": "9.4.41.v20210516-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:276f5088-0a07-5977-acbd-6af435056ec3", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:af581208-8316-5606-a878-ac93e81b51a3", "id": "CVE-2021-28169", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-28169 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet. Version 9.4.41.v20210516 is not vulnerable. Summary: The target repository (Jetty 9.4.41.v20210516) has the fix for CVE-2021-28169 applied. The vulnerability allowed doubly-encoded paths like '/%2557EB-INF/web.xml' to bypass security checks and access protected WEB-INF resources. The fix (commit 1c05b0bcb18) changed ConcatServlet.java line 130 to pass the original undecoded query parameter to RequestDispatcher instead of the decoded path, allowing the dispatcher's security me [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:735b1574-03da-56cf-b48e-99684abcb95a", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:689703c1-3bea-5f5b-81a7-591b78365ee1", "id": "CVE-2021-34429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b842d888-4aec-5ccb-9ef6-903ca09e3afd", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c6eb5de2-804b-5a46-b096-019ca3a2264b", "id": "CVE-2022-2048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2048 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3b437ac2-1a2e-5694-9199-3f4966beb71f", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dd075dd2-cdf2-5add-9b32-70c326f70fd3", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:17651c83-a16d-5aa9-a996-f8a35bff2f26", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b2d9ec43-2fa3-5f09-84e3-881093ecf653", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:41981c88-1f5e-5da1-a09c-654b2528a01d", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:48f61840-5b2c-53b8-8ded-9a69b8ce8c6c", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e700b6df-097c-5663-8e7b-652c6415a797", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:45451005-d40f-520b-be7a-2698feb9b8a1", "id": "CVE-2024-13009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:39a54300-faae-5e85-93cb-4dad2a34e26c", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1df0db0d-42db-5d70-a1e9-2e186c586a4a", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:332c5aae-304f-55f4-922b-0ceaa8ff9731", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:788a293c-d50a-5b1d-9e48-9ba6c987c139", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:40a243d7-d476-501e-a361-f2e8d19207cd", "id": "CVE-2024-9823", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ba571f6e-1ccf-5a9c-bc5f-d67ebbca218e", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7695ba1a-db1e-5635-8fef-921930cb5fa2", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0211db29-5020-5212-8bab-cad3fe682bfa", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7cd0c058-0858-5cf5-ab8e-dd62d38175ed", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-10051. The vulnerability describes HTTP request trailer cross-request leakage in Jetty 12.x where the _trailers field was not reset between requests. However, Jetty 9.4.41 already contains the fix from upstream commit be1eb26670 (July 2017, Simone Bordet), which properly resets _trailers to null in the recycle() method called after each request..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:37ec2e06-0371-5810-a830-f22113bf0325", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet. Version 9.4.41.v20210516 is not vulnerable. Summary: Target repository is Jetty 9.4.41.v20210516, which is outside the affected version range (12.0.0-12.0.31 and 12.1.0-12.0.5) and has a fundamentally different architecture that does not contain the vulnerable code patterns. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7df936b4-58a7-5dbe-a592-14f549f71d6e", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d1206151-e263-510c-96d5-22bf10a4dde1", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aca380e9-6bf6-59a5-8985-ce12d797f8f9", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-8384. The target version includes upstream fixes from February 2021 (issue #4275, commits 20ef71fe5d7 and f9b5974dedf) that add ambiguous URI path parameter checking. These fixes prevent exploitation of the semicolon-followed-by-dot-segment pattern described in the CVE by rejecting such URIs with a BadMessageException before they reach security..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2bb63304-0bba-5bd3-8c9a-2cb1791a4864", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-servlet@9.4.41.v20210516-tuxcare.2" } ] }