{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d560e6ef-7e2c-5edc-90f8-74bfeae87237", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee8-websocket-javax-server", "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee8.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee8-websocket-javax-server", "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee8.websocket", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ee776c15-da01-5e82-a508-7b10a01e8408", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ddab2d91-bce4-5f99-a44b-3a68615169ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d5fdbca8-0c0b-58ea-9314-b175738d19b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4f150478-d297-59ee-b30a-be36e57ef20b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:779f18ec-2277-50c0-a808-044f1f0c7ef6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0bab48c8-a8ba-5312-9c3b-bddd27b973f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c52dbbde-fb52-5ddb-a738-802737e642ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dcaa18a4-8f7f-5589-b699-71f5237a6c45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4be54bb6-3cbb-51d0-9cac-8c4b4ef094b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d2c135ab-2e9d-5312-b908-47ec058444ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2a48c021-53a3-5991-aa47-4061270d232f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9949b31e-c09d-51d9-9474-56aea8e025b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ffac614f-8c44-5c5b-b20a-400dafdfcfe7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:849545b8-16cf-5cb0-8db4-31cba9209a5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9199274a-7035-5df3-ae33-68c8323f5b00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:27d6f7c5-2b1b-59ef-a1bb-85ab48a947da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1cd50f87-2138-5717-88e0-4eb702dda414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b4749412-618f-5834-aa6b-8a47066a7bd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:61d7a1a2-2b0e-547e-b8a8-fb687adefa1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fde40b31-150d-51df-b504-ea6922d6ceb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6fdaf1c0-e5b9-58fb-8e6c-043b6fff825a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:65af603e-7559-5698-b9e9-a9f9cf210f48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2a9c3f33-1b86-5e64-a109-174b724804d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:845bfce0-d92a-5d58-ae8f-4aec74086a0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:269c079a-4cd2-5c87-9daa-74a12504f72c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:46eb6621-fd4d-558b-8d23-323df8e61422", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0f9c7713-27e6-5034-bd52-3baa026301ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7b63bf37-663c-51d8-b600-c11c2bb447de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1f05a072-23a8-500a-b988-85018f451f70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:58882523-54c4-5335-8122-b98351c86bc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2fcf9013-4a5b-5262-b216-431e4f73e7e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a852dc1d-3518-5d28-818c-f6fea158f4c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a54333ff-4892-523a-a445-31d07a7bb3eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ea9728c1-ab0a-5659-ac7e-b3378c004f25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:93bbd9af-2978-503c-a9db-0f66cd53c734", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e69308c1-83e8-5fb4-be2e-8f025b84595d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:eb05b354-02f9-5216-a6f7-a01da841583e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:af7f51ac-2e82-56e2-b08f-b44464d145c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a28186f3-9b79-5895-a149-d87eca705db8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:df02bf98-9863-5d07-b662-81dcb9575964", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5c555674-38ce-5493-858e-627f08a18c4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:76188765-fb6f-55c7-8d01-288358d4beea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c84bfd3b-058c-5ec0-bc33-d047ce6e0051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:59c8353c-cfe4-54ab-b9b9-bf60bed1dacb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-javax-server@12.0.22-tuxcare.1" } ] }