{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:46006186-2745-55c2-92ae-7a9bcd0ab6fd", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-continuation", "version": "9.4.24.v20191120-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6fb68098-3e7f-5d79-bdd1-e0f08b19f1f5", "id": "CVE-2019-17638", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-17638 does not affect version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation. CVE-2019-17638 depends on the response-header overflow handling that Eclipse Jetty introduced during the 9.4.27 development cycle. In the affected releases, HttpGenerator signals an oversized response header with a HEADER_OVERFLOW result, and HttpConnection.SendCallback.process() handles it by releasing the header ByteBuffer back to the ByteBufferPool and only afterwards throwing BadMessageException, leaving the field still referencing the released buffer so that the subsequent failure cleanup releases it a second time. The same buffer can then be handed out to two connections at once, and one client receives response data belonging to another. That handling does not exist in 9.4.24.v20191120. HttpGenerator.Result has no HEADER_OVERFLOW value, and generateResponse() deals with an oversized response header entirely within itself: it catches BufferOverflowException and throws BadMessageException(500, \\\"Response header too large\\\") without ever touching the buffer pool (jetty-http/src/main/java/org/eclipse/jetty/http/HttpGenerator.java). In HttpConnection, the header buffer is acquired once at the configured full response-header size \u2014 the generator requests it only when the field is null \u2014 and the entire source tree releases it in exactly one place, SendCallback.release(), which null-checks the field and clears it immediately after releasing. That method is reached only from onCompleteSuccess() or onCompleteFailure(), exactly one of which runs once per response. An overflow therefore yields a single release, and no buffer can be returned to the pool twice. This is consistent with the published advisory, which scopes the vulnerability to 9.4.27.v20200227 through 9.4.29.v20200521 and records the fix in 9.4.30.v20200611." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:04b56d77-1db9-59b3-ae1f-a61cc630e25f", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:34f6ce17-21bc-5c15-9c08-844e9b8d4602", "id": "CVE-2020-27218", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c0a3f94e-edcf-5df0-93e1-17a5d399ef18", "id": "CVE-2020-27223", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0ed3cd86-65bb-56be-9bf4-8548097ea48d", "id": "CVE-2021-28165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28165 is fixed in version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0803d7d0-98ac-583b-bcfe-17c53003b4dd", "id": "CVE-2021-28169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8f2a063e-1828-5745-950b-31402de0c510", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:04d695fd-ead8-5eaf-9c56-443c79f6011d", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e9e95dde-1305-55ad-9c72-ab0e58c59ce2", "id": "CVE-2022-2048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f95a9c89-5132-5340-84b8-9e7efc9ec854", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c06120e0-60ad-58cb-9224-0a1227a5a5e6", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:44259dc3-0b4e-5b3b-be50-fbb7fa37abe6", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1b1791ce-4505-5eba-8c58-fe2626c5f3f9", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9b61a636-6ffd-5ad2-899b-65052844803e", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:39e5167f-7603-548d-a6b2-f18a877364bb", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f8335056-2195-5bd1-8799-f6959737fa02", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fc4b9374-da9b-5cc8-8dc8-86b85bab5306", "id": "CVE-2024-13009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:242af670-f22a-5591-89e6-e47e3dd0bf69", "id": "CVE-2024-22201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:30f00280-7296-5817-a720-bdddf561f535", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b4df9280-6242-5324-a72c-989570b5f0c6", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:69dfdd7c-05d5-587e-870b-dd733ae12ac1", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:01616dc9-71df-5d47-b52c-1e352e23e1c4", "id": "CVE-2024-9823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9df12c7c-ba9f-5e9a-87a1-071a88e17243", "id": "CVE-2025-11143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:40e0249a-c685-5b64-bb3a-ff9cb7b00b86", "id": "CVE-2025-1948", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:90332369-fecc-53d9-954b-3cafa479cb68", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c32fdf09-984f-5abf-a677-a56f1a99b1a5", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:30be4fb7-6558-5e10-8d92-1610f3799607", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation. not_affected \u2014 Jetty 9.4.24 is NOT AFFECTED by CVE-2026-10051. The vulnerability exists in Jetty 12.x/11.x where _trailers is a connection-scoped field in HttpConnection that is never reset between requests. In contrast, Jetty 9.4.24 uses a fundamentally different architecture where _trailers is in HttpChannelOverHttp (a channel object that is recycled per-request), and the recycle() method explicitly sets _t..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bd2eab6a-c3c6-5f05-a8d3-b6b1cb34a41c", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation. Jetty 9.4.24 is not affected by CVE-2026-1605. The vulnerability describes a memory leak specific to Jetty 12.x architecture where GzipRequest objects are created but their destroy() method is not called when only request inflation (no response deflation) occurs. Jetty 9.4.24 uses a completely different architecture without GzipRequest, GzipResponseAndCallback, or the conditional callback wrapping pattern. Instead, it uses GzipHttpInputInterceptor with a recycle-based cleanup mechanism (HttpInput.recycle() \u2192 interceptor.destroy() \u2192 Inflater.end()) that does not exhibit the specific vulnerability pattern described in the CVE." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5fac475a-1e6b-50a0-943c-6895e610cd4d", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9a1c4e7b-9ee6-572d-a4a7-fe6d30426367", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1100ea9a-6fdd-5283-94c7-7ce4a76fe7da", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation. not_affected \u2014 Jetty 9.4.24.v20191120 is not affected by CVE-2026-8384. The vulnerable code pattern (canonicalPath with integrated semicolon handling that fails to update the character variable, causing slash-state tracking to fail) does not exist in this version. Jetty 9.4.24 uses a two-stage architecture where URIUtil.decodePath() strips semicolon path parameters before URIUtil.canonicalPath() normalizes do..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ef69d776-a4c0-5f8d-92bd-e420761a0974", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 9.4.24.v20191120-tuxcare.3 of org.eclipse.jetty:jetty-continuation." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.24.v20191120-tuxcare.3" } ] }