{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3a91b4ac-ed96-52a3-886b-4cb1d5d2192b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee10-jndi", "purl": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee10", "bom-ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee10-jndi", "purl": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee10", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:77ffa4b1-30fc-55f2-bb13-69787146cf7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:72442ff1-8578-5a2e-8f37-7c6ae63080e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:901af4ae-d6ad-592c-9a2c-e64f3219a616", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:eec5a4ec-5e94-5f2e-87f9-909c1be700d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:41815b7f-6e6f-5020-9d00-8a9d04e07afe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4ac3bce3-1823-5a7f-9673-2a016459f89c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5fc4221a-c443-56f6-8504-b0963dc4747e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aa5992dc-7d33-5429-984b-1676941087d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:35d7ca8e-1be0-5aac-9ad9-121f7c3dd102", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:097c6cde-6602-52ee-afa4-36cd3ab409a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:867b4813-34f6-5a36-869a-603dd9122ea2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:eddd6469-91ad-5a56-b0d4-703f7876973a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1b6ab3ca-5428-5c6a-8015-6c2548eb3b77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6cf6489b-8d07-5a8c-abe2-7156bb478e58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1e53a549-b5dd-53a0-92bb-c7892bde2b0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:796cb213-fd64-5ab3-8587-338b190311b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cb1ab985-1fcf-5860-9b77-5819a569dd49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:28d737e8-ce9c-5719-a2d6-c7f8c0b58dd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:13797904-b6ef-5147-9a0c-f3f0eb5ccf67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5d008f18-5b4a-546e-b7ab-17da251cb2c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ce471c8d-f7ad-58cd-9102-677aa3e5283d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0a1f3b52-f990-592d-bafe-42e9c424ace7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cad170b1-b6a9-5a88-a026-94a8067c2ea6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9f7a0ccf-6094-59e8-86ec-225e03e2b1e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6cdea207-af5a-5136-8757-bd04a3dfc4e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7252c515-6075-5524-823d-a50270842f7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4d4f6645-d487-511d-a5a1-1a00fe044c6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3a6ad9f5-ad8f-531c-808b-529c24cb8516", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:39b19d17-3714-59d1-982e-5c802bcb1333", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e8430bd0-1f89-577e-9526-cd6edc5bbf4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8e10a0af-d3fb-5ce3-8939-502486c40f8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0029219b-d824-5230-9a07-64f54f560397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1ea68045-489b-554f-b9f3-934f55a89f27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:90ff89bf-870d-5354-92fb-0c675c0814e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9ac7bd65-403d-539b-9de5-8bac80091abc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c57b1bd9-7616-5f14-b73a-5baea877661c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a3365239-1642-5f66-8672-0936b80e1121", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c476bd3f-1aa4-5007-9495-962163683516", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2025-1948", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ead06e9d-ba80-54e9-8d2b-d328bf589966", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:61d04032-bef2-5c60-9ddc-41efa1bfb390", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cbdfefa9-247a-536a-a02c-4c846e765c0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a166b7e2-60f3-5df6-b957-99e702efdaeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0f2f96de-847e-5ee6-a5bb-0822b84639c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:19db68d4-24b1-576f-aca7-453c51bfad72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c1248bc3-8558-55b2-b29f-aff6bcdde820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5a5817e7-9a1f-501e-9de1-3e50f252443f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:de648ade-e087-5c69-9fb1-c5f1e686e39c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a474cb97-67d4-5ae1-811b-74466b5cd6af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4e52dfa7-59cd-54c2-aefa-4818aa3b6d13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e1875703-f774-574d-aafd-ccb7362b54bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9749f27f-2889-55b1-b195-792eca938f5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a52137b1-bb65-5de3-a6ce-73ae72be9b91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:73d41a2b-ed40-5a4d-abf1-380c9c173436", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-jndi." } }, { "id": "GHSA-gc59-r5jq-98qw", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6ba8d26c-c174-5221-bf33-2880f4312a6c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.ee10:jetty-ee10-jndi 12.0.22-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-jndi@12.0.22-tuxcare.1" } ] }