{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d43079f0-a607-56ae-b6ab-10a67279d639", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3", "type": "library", "group": "org.eclipse.jetty", "name": "jetty-xml", "version": "9.4.41.v20210516-tuxcare.3", "purl": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e4eb2ceb-e1a0-5e1f-b641-64b23a05879f", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4400920d-299b-529c-b01e-88a9bf3a2fc8", "id": "CVE-2021-28169", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-28169 does not affect version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml. Version 9.4.41.v20210516 is not vulnerable. Summary: The target repository (Jetty 9.4.41.v20210516) has the fix for CVE-2021-28169 applied. The vulnerability allowed doubly-encoded paths like '/%2557EB-INF/web.xml' to bypass security checks and access protected WEB-INF resources. The fix (commit 1c05b0bcb18) changed ConcatServlet.java line 130 to pass the original undecoded query parameter to RequestDispatcher instead of the decoded path, allowing the dispatcher's security me [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:85889473-24fc-5123-adde-1bbf4b7f9c4d", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5d456dd9-b46d-5e2e-a8df-5daa0610a955", "id": "CVE-2021-34429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:63b97e8e-6902-5e2a-b0a0-ec3e06d409fe", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f3484464-21bd-59f8-b105-5e5d0fb9c434", "id": "CVE-2022-2048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2048 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:21143d45-3f6b-5134-aadc-370eb8939916", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1aa1088d-d85e-5c88-a4a5-b73292315228", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1db3f030-2111-5f4f-8559-8bf12ed41b9f", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:373de1ee-f8dd-5379-bd3d-b15f39c858a5", "id": "CVE-2023-36479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:02098f7f-36b8-5e79-9c83-0aca5d37f334", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:16bad293-c221-5433-a1de-9b1e17e891a9", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6953abe3-4ba6-56bf-84d8-5610967aba22", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:88f56cba-aab7-57c7-b440-5ddff7cceede", "id": "CVE-2024-13009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:95e9c7e8-8e91-59ed-b3c8-ec2d992f540b", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fbb27b21-26dc-5b32-884e-10cd5c4c9321", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:be289c70-e647-5771-8e47-9d118353b074", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6784354f-f9af-5721-9ddf-eedb74424b6c", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6418a777-83c6-5212-a86f-92d4046c55c2", "id": "CVE-2024-9823", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cd96bee8-f358-50d6-826e-3c53c2e8d56e", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c821e99c-3294-52b1-a294-4139e3e87738", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:151d395b-b7ab-5916-883d-bc507e69edd1", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a015bb03-4a25-574e-960c-39192bebda64", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-10051. The vulnerability describes HTTP request trailer cross-request leakage in Jetty 12.x where the _trailers field was not reset between requests. However, Jetty 9.4.41 already contains the fix from upstream commit be1eb26670 (July 2017, Simone Bordet), which properly resets _trailers to null in the recycle() method called after each request..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:99b7088b-bbe5-5f17-81ec-869e6832769e", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml. Version 9.4.41.v20210516 is not vulnerable. Summary: Target repository is Jetty 9.4.41.v20210516, which is outside the affected version range (12.0.0-12.0.31 and 12.1.0-12.0.5) and has a fundamentally different architecture that does not contain the vulnerable code patterns. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fabee21a-2be3-569d-acff-d35090a49043", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8753ff33-204f-533b-80ce-88e1a775ee78", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9b4754a8-bf86-5522-9900-fb6b0c44f9f5", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-8384. The target version includes upstream fixes from February 2021 (issue #4275, commits 20ef71fe5d7 and f9b5974dedf) that add ambiguous URI path parameter checking. These fixes prevent exploitation of the semicolon-followed-by-dot-segment pattern described in the CVE by rejecting such URIs with a BadMessageException before they reach security..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:291403e3-a9c4-536c-aab7-118e184774b0", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.41.v20210516-tuxcare.3 of org.eclipse.jetty:jetty-xml." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516-tuxcare.3" } ] }