{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:93f9b465-1a14-5506-b3c2-04a3b62dc8ca", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "documentation-parent", "purl": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.documentation", "bom-ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1", "version": "11.0.18-tuxcare.1", "pedigree": { "ancestors": [ { "name": "documentation-parent", "purl": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18", "type": "library", "group": "org.eclipse.jetty.documentation", "version": "11.0.18" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:e9e0899b-5627-592b-b1fe-3027df45246d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:a21b1d28-a88d-5d3f-887f-484b9172a3f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:7dc898ca-480d-5e02-868b-2e2d81d99d4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:93c7cfe1-700d-545e-b592-28166dda9cf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:7a633581-fbb3-56e3-ab4e-e37f66b612e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:9ba20a7f-1e8f-5f35-8b7b-4ff38a2ee556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:8ed56a7b-da1a-5c8d-8af7-8df5ce7fc8ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:67d15105-333e-5892-93d4-e7ddcec95d13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:3e1ab7ec-21b4-5bf9-9f4d-f40d4121ff04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:f247d984-1b12-5c1d-9085-b6d041c154de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:6ea0c029-b4df-56a4-af75-6703df16cf2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:e41db994-95de-590d-9019-ac99de93e66a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:2c0257e4-2441-5a89-8de8-31848af0e53b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:bf8c7de2-a089-5b0c-974a-757fa0031046", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:58994060-7c49-5c10-8bf1-5d4d8581f252", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:7cce492e-c4d4-5c3c-88f4-a670e1755175", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:61efbd98-9842-5c56-9a08-36300e1eb7db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:8c59f083-fe1c-52e5-b71c-0e43dc353f5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:5e642a4a-1c6c-58f0-9c41-e023a0020d54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:8cf42940-30d7-5df7-8272-4fd138049a73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-28164", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:e9defa6f-6fd5-5aea-b729-580f0c565790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28164 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:d3a3cec9-e245-51c9-929d-33f87ee6f2ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:2a96c7d7-71b5-5996-a008-47df4e4fbd6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:474cab39-b396-5634-8bef-20cd0f918d90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-34429", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:7a1f4c97-0783-56dc-98e4-63d6cc9815d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:e20e6572-ea90-5a6d-9d72-e454ca4fedc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2022-2048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:e563344b-ef30-5f7c-bac1-0790085cb181", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:fd6c8c65-20a1-5cc9-af3b-51513c74ab82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:320af43b-3eae-5874-9c8a-f256560885c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:a16231e9-0cb4-5a75-ab7b-ec76ac820b01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:bbac336a-3a7f-5c46-9623-8cbccc6009f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:b1c81ac9-1319-5a13-8722-ab4386b41291", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:52d26e9d-67eb-5d62-b7d6-50f658a96472", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:9126bbba-c28b-5a50-8bd1-efcada404384", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:85af0a91-1729-5062-b828-5bdc46e7fcd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:564748a1-6d9f-5fbe-916e-ad5508da91fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:4b9b51fc-1259-581c-b70a-8a6cdb8a1d9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:57da6d2e-21a8-55f3-8d05-ba2b48d63803", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6762 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent. not_affected \u2014 Target version 11.0.18 already contains the upstream vendor's fix for CVE-2024-6762. Both PushSessionCacheFilter and PushCacheFilter are deprecated with warnings that they are \"example class not suitable for production.\" This deprecation was added by upstream Jetty developers (Lachlan Roberts, lachlan@webtide.com) in May-October 2023 and was included in the upstream Jetty 11.0.18 release before...", "justification": "code_not_present" } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:56a3d314-5918-59d2-ab83-fb401fecdbcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:13118d52-f22d-5f09-a1c8-5fea7a934977", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:ba67d204-06d2-551d-a35c-d90809df21bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:96047a2d-a5d3-5dc4-b17a-94863bfe91ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:9fc6381f-cef3-5acd-8431-611b58b08a77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:46edcda7-a456-52a2-9833-f8fa17ac676c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:380a167e-9696-5e5a-b6e1-2c2d94675f1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:6f320e5d-2997-583b-9ed2-33b3614be437", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:3b4cb158-8614-5d80-81ce-6df8ec4fa54e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent. Jetty 11.0.18 is not affected by CVE-2026-1605. The vulnerability exists in Jetty 12.0.30 due to a specific architectural pattern where GzipRequest.destroy() is not called when only request inflation occurs (no response deflation). Jetty 11 uses a fundamentally different architecture: GzipHttpInputInterceptor handles inflation independently, and its lifecycle is managed by the HttpInput recycling mechanism which ensures destroy() is always called when request processing completes, regardless of whether response deflation occurs. The input and output handling are architecturally separate in Jetty 11, eliminating the conditional logic flaw that causes the leak in Jetty 12.", "justification": "code_not_present" } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:c3001a49-586b-5738-8f36-5de55e9b7750", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:c127dc26-6534-5f09-ae16-18d22d3c46ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:0602b2ac-373d-5b26-b906-930fd87c693a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:6954cb7f-ee49-5b9a-819f-b0b7f0f630e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:e05ec0bf-1687-59f9-b79f-989eab505a5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:c09e0839-1b2c-5bb5-aa2b-fd888d56adee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:19cb4ea7-5130-5498-a872-dcfd21c0da12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:f01b90e3-c130-59c6-bb9a-1586b8ba0549", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:02b40c64-c06a-5c2c-83ce-95580514a62d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent. not_affected \u2014 Jetty 11.0.18 is NOT AFFECTED by CVE-2026-8384. The vulnerability is specific to Jetty 12's refactored architecture where URIUtil.canonicalPath() was redesigned to handle encoding, semicolon path parameters, and dot normalization in a single method. Jetty 11 uses a fundamentally different two-method approach: decodePath() strips semicolons first, then canonicalPath() normalizes dots separately....", "justification": "code_not_reachable" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:75ff7336-bfae-5d05-a7f7-be7785584ecd", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.documentation:documentation-parent. not_affected \u2014 GHSA-58qw-p7qm-5rvh concerns Jetty's XmlParser being XXE-capable. The advisory is explicitly informational (\"not considered a vulnerability of the Jetty server itself... No CVE will be allocated\"); the named remediation is PR #10067, which adds the ability to configure the SAXParserFactory (an overridable newSAXParserFactory() hook + getSAXParser() accessor), NOT XXE-hardening-by-default. The target (Jetty 11.0.18, SHA a459f013996) ALREADY contains PR #10067: commit 9a05c75ad28 is an ancestor of HEAD and of the jetty-11.0.18 tag. XmlParser.java uses newSAXParserFactory() in the constructor (line 69) and setValidating() (line 95), defines the hook (lines 86-89), exposes getSAXParser() (lines 137-140), and its resolveEntity() (lines 264-300) has the restricted \"only serve entity if found\" logic. The target matches the post-fix pattern exactly, not the pre-fix pattern (hardcoded SAXParserFactory.newInstance() with no hook). The fix is upstream-authored (Joakim Erdfelt), present in the release base before any TuxCare commit. TuxCare backported the SAME changes to older 9.x lines (9.2.16/9.4.41/9.4.48/9.4.50) precisely because those lacked the upstream fix; 11.0.18 needed no backport because upstream already shipped it. Verdict: not_affected (upstream fix present in shipped version). [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.18-tuxcare.1" } ] }