{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e380ca45-cb74-5d3b-b790-3b32c08c4263", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "documentation-parent", "purl": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004", "type": "library", "group": "org.eclipse.jetty.documentation", "bom-ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004", "version": "11.0.29.tuxcare0004", "pedigree": { "ancestors": [ { "name": "documentation-parent", "purl": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29", "type": "library", "group": "org.eclipse.jetty.documentation", "version": "11.0.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:2d5a2e7f-0953-54d0-9032-d6023b3d9182", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:ebf2189f-03d6-5569-a5ca-2791a372e267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:db54e4df-13a9-5e01-9708-3eb5272f25fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:2e59baa5-402a-5266-a8f3-d64eeb6a4551", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:a8ba77d3-8c42-598e-bf32-b0d7cbc3f441", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:f00555e0-df6f-5eb1-850c-494e0f142a6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:e80185ec-75e8-5dc7-b464-5a4b1ea262d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:67cf2e63-1b11-5db2-b9da-b07b98aa5dc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:b0760146-bbcc-58f4-aa88-f39857a0a55a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:7a024f1d-bb4d-52b8-9ce2-cde99a064795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:21539a58-8595-5099-a6c9-7f47fc4dca54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:0d00851b-fca5-58b4-aa44-5ec3cc8b29e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:63cee3fe-4ab9-5eae-8a21-9c07d08cc674", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:f58c60ef-d66c-5f96-b0c9-9b9e22929bb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:95daa758-1f96-5edb-b500-819d066e67cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:2b3b3df8-ac61-5f41-8dbe-361c5190ff93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:e9dfe89b-e482-5fb7-b6eb-d777ada1d579", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:ce32283e-f230-5d05-b54f-5407ca19c523", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:9e317be4-8702-5eb9-9a5c-ed00428a02a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:e2723d18-979f-5294-b9c3-0817b1df72d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-28164", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:3da6346f-d82e-5a3b-b8cb-e108e9b549a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28164 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:99a1d611-6db4-5a23-85a9-8da4214a7791", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:3be64cc9-77a4-5a70-b0a4-bde680e16993", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:9edb8ab1-5356-50c5-8d4b-e78daae9e150", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2021-34429", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:d85db4b0-731c-5c37-961f-95fa6c1d4c28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:4fda5a66-68c2-5389-9aa4-883fca21ae47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2022-2048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:f9bd0739-5fef-5ac4-bfe1-8239aba3d63a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:08204097-72c8-5f73-a4f1-9f18a5188457", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:ead9ea08-47bf-5fbe-9981-4f24afda172f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:b42b9372-63e6-5f8a-8976-ca431a8b9521", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:84ad1ace-a0bb-536b-9559-0e912e786461", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:f17feb68-fca1-526c-b4fb-f962d32ffcf8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36479 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent. Version 11.0.29 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:bac8704b-eab0-51bc-ac25-f6f7e37954e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:7a51516a-27a0-5ccc-85ac-1578582ac65b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:8e47ee8e-757c-5f9e-b14a-49aaac4721ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:d0f803a2-dcc0-5e39-b96a-857c04c2b1a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:5ce29e02-03fe-56ef-ba85-96858c6e4714", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:bb52db38-fda4-51a1-91da-168c68a5fbaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:1ccfb3ef-b688-5a8e-8d6e-038af7fd95d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:72312b7e-a221-5ba8-b496-4bb937da6c8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:69c58142-2af1-5692-bc64-aa8d77a5d898", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:0ac838a6-20b3-5a03-98a9-b661b5e96255", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:a6ebcd3d-3eba-5331-b651-bce4dab4b802", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:ee6c7859-5bd0-55ba-9d36-af937cd2799a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:a508a182-e0d0-586e-b97b-0a27a0ba75be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:7fd0853d-9f76-5e80-8dbd-c150ba7acf1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:12ada0c1-f098-5708-b9f2-88fb63e26454", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:148dde9b-c4fc-5691-a1d5-570cc40b8511", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:690de31b-4489-5392-b16a-bfe5168c4ecd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:28bb8a0d-8a06-5ea4-9d2e-26aefd92de29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:eabfc4af-5e1d-573f-9a26-a699db807fb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:939b4a8d-804b-502a-941d-010936636d64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:273244cc-3266-5b50-8e80-004103fb98b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:ba657f47-e39c-5d5c-a92d-80a5c5937dc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:657098cf-608a-5171-88f4-40322e4cbb4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:527266e6-dc09-5124-83c3-3a3a40200223", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent. not_affected \u2014 Jetty 11.0.29 uses a fundamentally different architecture from the vulnerable Jetty 12.x code. The CVE describes a bug in Jetty 12's single-pass canonicalPath() method that performs both parameter stripping and path normalization inline. Jetty 11 uses a two-pass architecture where decodePath() strips semicolon parameters first, then canonicalPath() normalizes the result separately. This archite...", "justification": "code_not_present" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:6bf10731-209f-5bca-b3a9-44260db300f6", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.documentation:documentation-parent." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.documentation/documentation-parent@11.0.29.tuxcare0004" } ] }