{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3e8ac90e-8c5f-5e44-8211-072cca20de16", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-jmx", "version": "9.4.41.v20210516-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:16a2d4f6-a8de-5d52-8c39-559f0f240e76", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:79c95175-e4f4-5813-8aef-c081970b97e3", "id": "CVE-2021-28169", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-28169 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx. Version 9.4.41.v20210516 is not vulnerable. Summary: The target repository (Jetty 9.4.41.v20210516) has the fix for CVE-2021-28169 applied. The vulnerability allowed doubly-encoded paths like '/%2557EB-INF/web.xml' to bypass security checks and access protected WEB-INF resources. The fix (commit 1c05b0bcb18) changed ConcatServlet.java line 130 to pass the original undecoded query parameter to RequestDispatcher instead of the decoded path, allowing the dispatcher's security me [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b8b825c6-a082-5944-9883-f5ba7d6ba2c5", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b973bfb1-b6f0-58fb-a49d-178498e69bb0", "id": "CVE-2021-34429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d7f5e3a8-8e80-5fea-b408-9670968a43b7", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ae8a6270-62b6-54ea-89c9-e49816767b5e", "id": "CVE-2022-2048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2048 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0b832e1b-d0a3-5323-ad29-c28d5b4fe39a", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e4df0f2e-6edb-5d44-945f-61d6a670f983", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:957026ed-149d-50a3-b210-fe2bb9859493", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a3259188-ce22-5bd8-8567-b062cb1f9155", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:02e94ac3-0384-543a-b730-f30d499b7129", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:26613c69-5446-5aec-bb18-9a65c8dd1a0e", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a6b28ae7-0a33-5011-9e00-7de89dc60995", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3ae719ce-96c0-52c3-8596-e952ad2b7018", "id": "CVE-2024-13009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d423c1aa-a2be-5e37-87b6-f453058e949b", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7e4c53c6-c08d-5aa5-a5ff-51ce378b533b", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:27a7dbeb-9868-55a3-b44d-9e169c8ab3f6", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:60e0747e-e6a5-5e56-bd52-3190fdc7545e", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cc24cb5d-ceda-53c8-bc84-27180100e3b9", "id": "CVE-2024-9823", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0ee5e4b3-d3a5-5626-a7b9-3ba5d8b2003d", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c5898bee-b29c-59ac-aa1b-02e3542c91ca", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cc69a7dc-9059-5f5d-907b-ae21690e8f52", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a15b09bc-dd2e-5519-940f-b6f0ae6b86e7", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-10051. The vulnerability describes HTTP request trailer cross-request leakage in Jetty 12.x where the _trailers field was not reset between requests. However, Jetty 9.4.41 already contains the fix from upstream commit be1eb26670 (July 2017, Simone Bordet), which properly resets _trailers to null in the recycle() method called after each request..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4efab668-91eb-507e-8255-42646291a7e0", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx. Version 9.4.41.v20210516 is not vulnerable. Summary: Target repository is Jetty 9.4.41.v20210516, which is outside the affected version range (12.0.0-12.0.31 and 12.1.0-12.0.5) and has a fundamentally different architecture that does not contain the vulnerable code patterns. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:585e3fdc-c2bc-594e-83c0-0777cf36addb", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ccaae89b-bf80-50d3-8364-d8c8a8e5f901", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c5788364-e0e3-5267-acb3-48c92bfe158f", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-8384. The target version includes upstream fixes from February 2021 (issue #4275, commits 20ef71fe5d7 and f9b5974dedf) that add ambiguous URI path parameter checking. These fixes prevent exploitation of the semicolon-followed-by-dot-segment pattern described in the CVE by rejecting such URIs with a BadMessageException before they reach security..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9e6bd6f0-149f-566d-9e9d-5b41c141dd98", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-jmx." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-jmx@9.4.41.v20210516-tuxcare.2" } ] }