{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f95fafbc-ce42-5794-a730-1aa3f86e16ee", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-servlet", "version": "9.4.41.v20210516-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:83ca8de4-ce45-5111-869c-1132d3a146cd", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:181ba31c-4d33-57da-bd95-c55142ccf6b5", "id": "CVE-2021-28169", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-28169 does not affect version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet. Version 9.4.41.v20210516 is not vulnerable. Summary: The target repository (Jetty 9.4.41.v20210516) has the fix for CVE-2021-28169 applied. The vulnerability allowed doubly-encoded paths like '/%2557EB-INF/web.xml' to bypass security checks and access protected WEB-INF resources. The fix (commit 1c05b0bcb18) changed ConcatServlet.java line 130 to pass the original undecoded query parameter to RequestDispatcher instead of the decoded path, allowing the dispatcher's security me [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bfd59f28-f705-54fb-bb48-fc8c8b2e4383", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ce5027c1-dfcd-5c98-808e-a0ba65ef6d83", "id": "CVE-2021-34429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5fb4b71c-b079-5c25-aa90-acbb45467610", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ee2ac735-f053-5a47-850e-d011367bd670", "id": "CVE-2022-2048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2048 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ba1f8b20-9eef-5b2a-97e5-06fbf23f621e", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0ce14f54-7915-55ea-a9db-209563034ba1", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f05c1c7f-18be-5535-9065-c58362135ca2", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:14b24009-aba2-5f17-9b74-7519fcdf5fe2", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:44d30a6e-f5e0-58ca-9d82-9bf9eaa039d2", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4f398af1-1286-58ca-bd9d-6007e1676800", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:24dd1926-a048-572f-97fb-3fe00392f73f", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d3cffd4e-539e-571b-81f7-87f3b947caf9", "id": "CVE-2024-13009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e311042e-69d9-537a-b65d-da81c14e12f4", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:318f8979-54e5-5085-ab13-30672a48b158", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:06238cbd-11fc-5051-accb-d935a934bbe5", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a25bd879-9740-537d-9c23-2b20a928915e", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d0478aa7-6905-51bd-a38f-d6d36e9ff9d8", "id": "CVE-2024-9823", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f13409b6-f8c8-564e-bdda-b8a64873e836", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:38750528-b73b-5004-87a2-7ae53f29d2de", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:47314aae-45ac-56c8-946f-6a1669507ccb", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:847c5ada-9138-514e-affc-048fae01181f", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-10051. The vulnerability describes HTTP request trailer cross-request leakage in Jetty 12.x where the _trailers field was not reset between requests. However, Jetty 9.4.41 already contains the fix from upstream commit be1eb26670 (July 2017, Simone Bordet), which properly resets _trailers to null in the recycle() method called after each request..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:39f3ab8d-95ec-5b50-9cda-5c92099e9ff1", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet. Version 9.4.41.v20210516 is not vulnerable. Summary: Target repository is Jetty 9.4.41.v20210516, which is outside the affected version range (12.0.0-12.0.31 and 12.1.0-12.0.5) and has a fundamentally different architecture that does not contain the vulnerable code patterns. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a0331c5d-de5b-5e38-aa84-887cf9a2cff3", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1f0da246-ebba-56b8-bd73-bec9aa03575d", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:72fc9c3b-f213-5077-af0e-defcd4015b54", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-8384. The target version includes upstream fixes from February 2021 (issue #4275, commits 20ef71fe5d7 and f9b5974dedf) that add ambiguous URI path parameter checking. These fixes prevent exploitation of the semicolon-followed-by-dot-segment pattern described in the CVE by rejecting such URIs with a BadMessageException before they reach security..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:395dbfdb-d46e-5e1d-bd6e-068c995c1d4a", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-servlet." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516-tuxcare.3" } ] }