{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:82f4a545-de28-5797-ba13-e6df9e459238", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee8-jaspi", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee8", "bom-ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee8-jaspi", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee8", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e69c86d9-ff46-50ea-a820-2798074773a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e0032217-c9f8-54e7-bcef-8b2854e07f27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cdaa6dcd-857a-5798-81da-aa5dc65ac3b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2ab57ba1-1e4c-5c84-b94b-92672d75e129", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:caba49ea-50da-5dbc-aac2-8ef15cc217be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8cadaf9f-3b1d-57b0-a72d-c5ea72653dcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e4cce7f1-4c5c-5851-8f2f-d6646e522196", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:88ce24ea-b2b6-5886-a407-83462b10c93c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9873fecb-6fab-59d9-8733-fca651d5b0bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6e6e567f-60ac-5fa4-a849-8d16d7e363c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bba59c75-d74e-5d90-b9b0-664e7c113b13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2e4e6e69-a140-5eb7-8fed-4a6acd19d141", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:33b0b649-7dee-5f43-b6f6-4eb31cb99023", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3638c41f-ce94-51ac-9c6b-b4e8bc42b40c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:954ab056-456f-5746-bdbe-a9297edece79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a6dbd60f-753c-5d42-8328-0176a625fef1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ed35bd05-0f0e-53ac-8761-1a19c415a091", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:56d94161-4fd1-5a2b-9e14-91ff6be0f13f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:34155ff1-2f1d-56a4-bbd8-7d50a4ad9ae1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:77544835-4107-5f57-a80a-131fff6bf78f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4f7e31e6-4292-5ebf-874b-943ebd9dffea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:034452af-0e00-52ca-836b-e3249aaf272f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1a1402a8-8a2e-582e-ab46-28564f282009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f8da96b6-78f9-5f26-a11e-7da887b3418d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c52a9098-3c6e-5c44-a642-b7631665b117", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2ca23d02-ad1b-589f-9781-d8a5419f142c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d8f54aa6-7b5e-57ca-b341-75a53f2108ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c3a139a3-c554-563f-a4e6-ede88ae152c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e624b0b0-97fb-539f-9c7d-a6f2671fa1e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d0412b9a-0cd0-516e-8ef6-961f5b0b3b07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:db7b29dd-bd4c-580a-b352-3a40f7d7c6fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f429a278-39ad-5235-b5cb-5d76adca69e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9cefd6a3-8ce5-510d-abf4-28b68b1f86b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f299f02d-9879-5b83-8626-c15b4f3cfedd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:00eec032-55fa-5142-98a2-5550c48a98bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9570a2ed-0cdd-5707-8dd2-9e1a22972045", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:15781f63-29a0-5f81-b961-d77c8784e69f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f4efd78a-31be-5098-9000-9ac96d551101", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2025-1948", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:12109b3e-f9b4-5587-ad73-bb9cb5633c67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8a24dad9-775f-5069-8e56-398ea2df0d38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2b52c926-017e-5948-8768-339f34d39acf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b95b3bfb-2c54-5c8a-8d85-8973a735f696", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:421d44c9-ce36-54a6-933a-ce4dc18a4de0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bc7193e2-d196-5cfc-abb4-3207f87f02fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:48ae97f2-97b1-5ce2-abcc-cf3996981a36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fb6e51c5-f0fa-5a2d-af21-61ec0c0479bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:18ae7436-3710-5a4a-a18d-d59e95b8366c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3ecc5233-582d-5b29-b3c6-0c6e837b5ab1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:09261943-a660-5428-a8ce-d6d74e4601e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d9add7b2-fa86-5a75-8fbe-c43fe92a7d6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8e3b733f-3bcb-5769-843e-6f699736082a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:97e918b1-295e-5200-bfc5-1c15240f9baa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d49ab311-ac43-5501-8f5f-fb696e0c7d95", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-jaspi." } }, { "id": "GHSA-gc59-r5jq-98qw", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3cc8cb5c-36b0-532b-b4d9-6c323b6da550", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.ee8:jetty-ee8-jaspi 12.0.22-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-jaspi@12.0.22-tuxcare.1" } ] }