{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6953dc38-f4d0-51c7-8882-25a0f7c868a0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "jetty-ee8-websocket-jetty-server",
      "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1",
      "type": "library",
      "group": "org.eclipse.jetty.ee8.websocket",
      "bom-ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1",
      "version": "12.0.22-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "jetty-ee8-websocket-jetty-server",
            "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22",
            "type": "library",
            "group": "org.eclipse.jetty.ee8.websocket",
            "version": "12.0.22"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2006-6969",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0787e471-a6ac-5bff-bedd-fbc18345435d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6109bd2b-8a1d-5299-809a-65ea6cdd11df",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3acef320-3811-5d66-be55-e16cbc0a0dde",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2011-4461",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:edf58bd7-5106-5e67-aedf-b2176a308d37",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2015-2080",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b113d673-585b-5e8a-8133-e8b2d2ae6e89",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2016-4800",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:89d7925b-9891-576d-8508-cf299e4f5d55",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2017-7656",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a6b59733-59d5-5010-af8d-cfea1645ded3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2017-7657",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9e077d42-d96b-5e11-8eee-2bf9a1a81a7c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2017-7658",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c1244ac8-22ee-56e3-adb0-5224f8efb226",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2017-9735",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:59e8bbea-80aa-523c-add5-18196394e9fb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2018-12536",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ee2d7b84-a548-5969-a4ac-555a87e0571a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2018-12538",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d5c68f00-337b-55f6-953a-7021edd32077",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2018-12545",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7a537977-c6cf-50a6-8a09-a27842be1505",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2019-10241",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:94ea5bc1-1c65-5a58-926f-b89554b564b1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2019-10246",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:251859bd-870c-5346-91d6-ad744b25732e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2019-10247",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b9dcc7df-a916-56ef-b1be-6f2b9d31f8fb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2019-17632",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:74715214-fbee-5b36-9ed4-a163f1cfea57",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2019-17638",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b296d628-ab86-583b-a559-53a5956178e3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2020-27218",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e228f660-4dcd-5d0e-9b51-4968ac042297",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2020-27223",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c098b247-bd95-514a-8999-90bdb23f3338",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2021-28163",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7376644c-9da2-5233-9edb-318c13cb346c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2021-28165",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bbbd3bfd-9564-598f-8a29-a2ad367cbede",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2021-34428",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7cbd488e-15a8-53c0-9d43-37d461954149",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2022-2047",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ac2ca022-fce4-55e7-96e1-df02f29a2447",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2022-2191",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ef208b6c-dda3-5309-aea1-77801b8dc941",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2023-26048",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e6c50b94-7fad-503e-ab56-33aac73af511",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2023-26049",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d692418e-b740-571f-bfb7-83c9ef52f751",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2023-36479",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5d3193cd-3f07-5f6f-b82c-e87de182c71c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2023-40167",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e8576bd6-f3c1-5d63-bdc0-4cc70817842e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2023-41900",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4ddc2161-53f2-57f2-b1f9-d6d5a544fde8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d3eb208e-c0a1-5a92-aba1-0e32dfb8b446",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2024-13009",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e8c8aaa0-3e02-5931-bb81-ece496f3745d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2024-22201",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d151572e-ccac-5669-8b91-570778f95d76",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2024-6763",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:49ded9bd-ad38-5309-ba39-8a010bb9d818",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2024-7708",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ee6a63b4-01b5-5b26-bcbc-0113e50c4a48",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2024-8184",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:164c7c6a-110a-57f7-b37e-d981d34f72a3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2024-9823",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:75671fa1-4188-5ebf-b8d4-bd7a91391240",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2025-11143",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b5844a97-bf65-5cbf-9b74-6858089619e4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2025-1948",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:98bcee2d-9cf9-507c-a14c-0f58e3a6647e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2025-5115",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ba6fc5d7-419b-5783-a8ac-64f33cfc8134",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-10050",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7b15ea94-bfc3-5e06-96f8-fe1cbc64aa07",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-10051",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:12e57430-9abd-5725-85f4-12b302ff7141",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-1605",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ff1114ff-6a0f-526d-80ee-647875d0489e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-18659",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a256b951-255c-5630-a14b-0112d7331de5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-18660",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:17ffc46c-869c-5bc5-b1f6-63ac11e9a854",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-18661",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:868d0660-bf41-5977-b22e-ee1199e8d960",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-18662",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f7829336-c8bf-5209-b208-d2c03f7c8d21",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-19864",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e75fa358-aa9f-5cf8-8c97-10a898ba64c1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-2332",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bc3f5bed-7678-5258-b975-a843e95b1d29",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-5795",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:661cfa7f-3dee-5ea1-9fe6-1148597f48d8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-6790",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9a80a84f-d94c-57dc-ae0a-314f1590394c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "CVE-2026-8384",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ce754dba-8477-5908-9a02-e9631d111bbe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "GHSA-58qw-p7qm-5rvh",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5510879c-0a7f-54f7-adc8-25d04f4b9bfd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server."
      }
    },
    {
      "id": "GHSA-gc59-r5jq-98qw",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:75f779a2-9d1a-57b4-a943-0e43f63fa4df",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-server 12.0.22-tuxcare.1."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-server@12.0.22-tuxcare.1"
    }
  ]
}