{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3223735c-fb4b-5f2c-abaf-170850136bba",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "jetty-ee10-websocket-jetty-server",
      "purl": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1",
      "type": "library",
      "group": "org.eclipse.jetty.ee10.websocket",
      "bom-ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1",
      "version": "12.0.22-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "jetty-ee10-websocket-jetty-server",
            "purl": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22",
            "type": "library",
            "group": "org.eclipse.jetty.ee10.websocket",
            "version": "12.0.22"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2006-6969",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5c046cdf-8efe-557b-a9f2-64c26317f8a3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:558d6266-eafb-537d-ba4e-524ecf13baa5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8eb01da2-6c6f-5684-b2c9-ab88d59e09be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2011-4461",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:defa59e4-5d03-54c8-991e-d84ec59d532e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2015-2080",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7d0dfff8-35f2-534d-a213-1190f040a664",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2016-4800",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8bab0abd-43a5-51fc-911a-485cd0042453",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2017-7656",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a27df4a3-b87c-59dd-9289-c9d35a98da1b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2017-7657",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:29a7d243-7e72-57ab-be14-734de668f184",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2017-7658",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d7a77e11-7f79-505e-bff5-89bfcd858001",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2017-9735",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dac25879-95b0-5ba7-a558-c81ac9015f1d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2018-12536",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8b58cc4f-c4c1-5fa4-b0ff-c16fec34ffc3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2018-12538",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3caf28cb-0d6d-5359-a159-b0653fa93519",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2018-12545",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b1996e51-a397-56b0-ab06-015299a96f58",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2019-10241",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5879d87f-7e24-5ed5-a0b6-88cac242a8ba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2019-10246",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ac1a223e-5b56-5ac7-978a-1a449323a56d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2019-10247",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:57451f74-be50-54ff-8d75-c3f8a1578746",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2019-17632",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f7feea35-1517-5cdf-be82-f132d3ba92c0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2019-17638",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:adc2a961-203f-54eb-b38d-765543ece469",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2020-27218",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:56d8d4bb-e3fc-539a-a866-b3d59d8b04ac",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2020-27223",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2bd76420-4caf-5fc9-bdb8-9688cff94ac6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2021-28165",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0c12a15b-fc5e-5a54-911f-b1b70a98d0b3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2021-34428",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b4cb4afd-568b-5c50-a9ec-5ac66da6ada5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2022-2047",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6f82fb0d-0451-5bef-929a-dd706fe01d48",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2022-2191",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e662c24a-5006-5ccb-9541-fc78600db562",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2023-26048",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:eefa6ce7-fefd-5bbb-ab1d-c25188b26ea3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2023-26049",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6768d49a-a822-5514-93d9-aff4d10298e6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2023-40167",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:eaf4755e-706a-50e7-ba70-29f67ed84124",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2024-13009",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2808ea23-f596-52cf-af68-8d89891d43e0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2024-6763",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f30056e3-4909-5f9b-80df-642b40bf06ed",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2024-7708",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:871779d1-e6ce-5db8-9838-e7972934effb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2024-8184",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4e2fd3e8-6e54-555e-8586-43f6528507a3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2025-11143",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c40b2cf7-2456-5d6c-b056-63c0756f77df",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-10050",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5aa22cca-468e-51de-9e37-e88b31082316",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-10051",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cdebb281-1f83-55e4-bc6f-6ab04d3e9c7e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-1605",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bb2d4414-8527-58bb-80e7-cf2d830baa66",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-18659",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dbb2f991-eac9-5f6f-b3ab-b6bacc0faa29",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-18660",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c7a16370-0012-5037-be54-349975b9a1f1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-18661",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d54b587c-e5da-5516-8e19-57409ef64590",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-18662",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7c977c6c-a8b6-5c41-bd93-37105fb26852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-19864",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:106bd879-89c5-5d41-ab47-ab304fec2f87",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-2332",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7f89b09e-d5b6-524c-b254-3972ec4d9e5e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-6790",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:03ae86e4-ba84-5100-82d9-ca22c96bfa21",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-8384",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9a5879ed-309f-599e-aa32-39e3b5b3185a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    },
    {
      "id": "GHSA-58qw-p7qm-5rvh",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e2305ed1-e285-58fb-b33c-b0875ed97483",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.eclipse.jetty.ee10.websocket/jetty-ee10-websocket-jetty-server@12.0.22-tuxcare.1"
    }
  ]
}