{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0fa77e6c-2a9d-5cf1-8249-8a74df478887", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-webapp", "version": "9.4.41.v20210516-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:fa751087-433d-5452-a628-32d634d0263f", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4bb87f8b-2d2e-5e7f-af5c-a72476757fd2", "id": "CVE-2021-28169", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-28169 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp. Version 9.4.41.v20210516 is not vulnerable. Summary: The target repository (Jetty 9.4.41.v20210516) has the fix for CVE-2021-28169 applied. The vulnerability allowed doubly-encoded paths like '/%2557EB-INF/web.xml' to bypass security checks and access protected WEB-INF resources. The fix (commit 1c05b0bcb18) changed ConcatServlet.java line 130 to pass the original undecoded query parameter to RequestDispatcher instead of the decoded path, allowing the dispatcher's security me [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:61e3b58f-4724-5589-a692-8cc8aa2b4bac", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3fb53ce6-6d07-533c-983c-ed4e578c4965", "id": "CVE-2021-34429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:27f40b9c-e39c-595d-9a39-a4cc1087e720", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:076f175c-9e20-55d5-8cc3-88cea4a5fb3b", "id": "CVE-2022-2048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2048 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8c86c428-4653-52ba-9946-53c10b54fe27", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8ef28376-1a4a-5781-908d-641c09dd30f5", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:73f154b7-5e71-56c6-ab4a-9f8d5c0d5606", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f89c3f9a-b534-55d5-83cf-87b305a391cd", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:417662e2-247d-518c-a2cb-93c8e2b0632e", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:19197009-537b-5a16-a4f9-693207a9bea7", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4b42410d-2473-5c1d-89ab-3cfcb8c38013", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ee69349b-0889-5acb-8df1-dfc697f8f90d", "id": "CVE-2024-13009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:becbed1a-93c0-59ca-9bb8-100aca75e220", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:11f2dfd4-2d50-531b-a6d3-83b3332ba8a2", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9f3c9fd4-db10-531e-ad69-4a67f7c8aabb", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cab1ad75-78ff-586e-a491-f8ad30fe5491", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a2010903-994c-5443-ab80-e2c766dddced", "id": "CVE-2024-9823", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a98a14a9-dd7e-5e51-b214-14fc915e59ce", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c37e3485-9403-5c21-ad18-0e24adcb2f04", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e6a10922-cdad-57ee-933d-35701168da96", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8d7976d3-aad3-5001-9721-52db6df0b525", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-10051. The vulnerability describes HTTP request trailer cross-request leakage in Jetty 12.x where the _trailers field was not reset between requests. However, Jetty 9.4.41 already contains the fix from upstream commit be1eb26670 (July 2017, Simone Bordet), which properly resets _trailers to null in the recycle() method called after each request..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b37a3501-5a71-5b45-bcc9-e6efde50fd01", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp. Version 9.4.41.v20210516 is not vulnerable. Summary: Target repository is Jetty 9.4.41.v20210516, which is outside the affected version range (12.0.0-12.0.31 and 12.1.0-12.0.5) and has a fundamentally different architecture that does not contain the vulnerable code patterns. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:580cd2dc-0b3a-51af-a21e-fa06d0916018", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f0ae7601-d982-5329-af2c-aa7abf990465", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:732e702f-06e7-5689-a41a-04553e511075", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-8384. The target version includes upstream fixes from February 2021 (issue #4275, commits 20ef71fe5d7 and f9b5974dedf) that add ambiguous URI path parameter checking. These fixes prevent exploitation of the semicolon-followed-by-dot-segment pattern described in the CVE by rejecting such URIs with a BadMessageException before they reach security..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0cd2b0f0-1de5-51d7-8b8f-9190914df179", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-webapp." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516-tuxcare.2" } ] }