{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:088f46f1-c004-5312-851d-4590a6157f12", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee8-websocket", "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee8.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee8-websocket", "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee8.websocket", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8d958233-5d24-5105-8f2c-eaf7d164052d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:166b13b4-1250-5ade-a8ae-cdc04d8edd5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6238ecae-8a78-5ae8-9389-2c816061bc8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f44bb6c6-f348-5296-8ffe-c4d878754fd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ced5f15e-e23b-5020-833d-a293c940b1ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d8fac8cd-4bb5-59d2-9a87-ecff4a6e3c3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fe2c6ede-4623-5de9-965f-a14a822e149c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d5a54c8c-dcdc-5f8b-9b01-12b4d7ff48d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a8045a26-e4df-5cf1-89bb-852aa827291e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8284d5a0-ca48-5df3-8b24-33370c473afa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f91dfd22-0fcc-5702-a9d3-66dee8ad34d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d99c1c95-9d2f-5d7f-978c-ec4f681c6cae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0e37f622-7b56-5697-8b9b-2eb6ce3c4fa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:70711250-0027-5357-b145-6c8be4ef505d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ab12bcdb-e4ec-5696-bf60-cce5ffaec7f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e768e245-c3db-5e6f-8506-a185e2890f64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e8c8f512-a7e8-5997-b6cb-862cf497478d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:17de7b8f-18dd-5c86-8bc8-587bd76145ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:44a0ecd1-25c1-5d7d-98be-2925296b5bc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f00ca1f8-e4a9-5806-98b4-035be6c60e87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1a31e2eb-65e2-5fe7-876b-b5247f1e8d3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f0ea9e7d-4f99-5210-a8db-5b9430a9eb48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7feea671-ae3b-5578-a4c8-75e9feb78d65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4eebb248-713c-5692-8f83-3ba44cac9144", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c7f2adec-5468-5ff7-8032-650d07c586dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5ea08bed-402f-59fe-b0b4-1b6e027ec8b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e10540d9-a05a-56c0-b209-cee30d22e9de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:86b451d0-59fc-5dad-8e75-e0a860e95444", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e410de95-8ee4-5c4d-bf92-2e0a179a2d58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e4d38092-9185-5e0b-9111-2a9c2b8a5d34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:91167589-571c-54d6-b214-d4c57be376ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:35e5034d-1bd9-5a24-a7e9-f4a3f8c9a959", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9d35b28c-2b03-5173-a43b-e9cb9c4cbdcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3f1e0d27-8344-595f-8489-057c67cd3cfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:877ec153-b508-5be7-8152-6f1c61ac28aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:237be739-c5e2-5814-9afb-0ad64e612498", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b16a7fbb-4fad-58aa-943a-1bb365215703", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f005460d-f1cf-5b73-8558-31356b3c6c41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2025-1948", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:49ac951e-d8a9-5b68-bac3-761919f6fa6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5b98319d-8d50-5733-901e-cd5e20efa547", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3a13a262-d266-597a-94e7-5e72ee9c9b5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0541e685-1052-5159-a581-bdc5b06d6b93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:87c59ac7-73f6-58d2-9869-ee0d0fb5eebb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:10547034-9b1d-5756-8797-3aae7328380b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:207fac28-2ac4-573a-b557-9c65652a358b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e5e5d296-9967-5804-b014-10d3917fa428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9bcba980-6846-5343-bd08-bd3e51b422e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:943e71e3-b574-58ba-aac9-9eb7d5fe9cc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:466d3fab-55d5-576a-81ee-4aa5cd9b36e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6a9aae2e-46bc-5806-a956-63936f87f9f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f262e318-a8ca-56fb-ad91-da2d8933b196", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5a44d01d-4b7d-5959-96a6-937f511ad7a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a72324ef-eda3-54fb-a1e9-0ce6ed02579b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket." } }, { "id": "GHSA-gc59-r5jq-98qw", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a5a225c3-3061-5022-9b57-c1254818ad13", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket 12.0.22-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket@12.0.22-tuxcare.1" } ] }