{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d8e5b66-d3f6-5688-ba25-4833053a3980", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee8-plus", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee8", "bom-ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee8-plus", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee8", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b3ca2db6-a237-568a-b856-35bd2e32b031", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:522975f2-a806-5d56-8707-e6607e7cf39c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:843908d4-5151-5f87-b8d8-8d11b87e2066", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:abd25961-1ef3-5f8e-ace6-86985299b490", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aebd39b5-b99e-5273-b948-d84a788964ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5364a2eb-0443-5eac-a4ce-a9685a07e42e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:46bcf990-9df6-55b1-9b1e-00b76edd0430", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aeca4ed8-330f-5312-93ce-9b6963197a86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8eda7bf4-8f6f-5d23-b079-7f11e0f9ecf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7453abbc-44bd-56b4-8f27-0b52118b822f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d304c714-af09-5f13-8fb5-c386237ae3f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d22dc851-2718-5d3e-9fd3-526836c71992", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:51f81d82-8682-580a-94f5-2dd9d694c70c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5e35efd8-b609-5b0c-8548-f6afc9dfdbc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b04044ff-150d-57c5-8518-5b2d9898d47a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2ea431ed-e510-5e38-8c4e-8e03190a7bce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:77fdacca-da98-5b31-8365-3a139bb8744a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fa8dfdd4-2d0d-5194-99a9-25476d5fd20c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c2878f75-2195-59ae-8d70-84b19c9dc505", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1b9c34a5-f9f7-5329-b14f-cf0af5ddec81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b549816e-f5d4-5c3d-87f6-1ec9edc5e025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f664844c-5326-59a8-b58d-4d242ab279fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1c91f2fa-ede6-547d-b71f-bb31bdbf348f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a4432840-cd9b-57b1-9eca-9e84a7430153", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:47172cbc-fafb-5d4c-93a5-813a51bc2526", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e65c59d5-47d5-54df-9bd2-09497076caef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fb00b06b-9e00-5d74-b18f-1bf399e8464c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:edb8cec9-7c03-5f35-8c76-a887b4aac3d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d3f66909-7cab-5a70-972c-63373ddb7cb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:467fc698-9bec-5b50-85bc-c9671cdedcc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5016a10e-fbb8-5551-9eab-e4446affdc94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0f2b812e-6f3e-5763-b070-63963f2eaaca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7353c584-76d8-5229-94cf-bac51487e2bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d3cdbacb-821b-5e71-8ffb-2ffa4d5f4503", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2460f07b-d73c-5ae4-be37-b244e87a3096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f277eab1-0db3-5e89-966d-ba5378bd55b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b06d1790-8b74-5645-aceb-f498dee81dfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6c00dae1-b64f-57f5-a61c-746091bf9b2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2025-1948", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a5dfa676-afc7-5fa7-9016-12fcc75e1465", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0f600ac2-b2b1-51cc-b6ea-af23931ad099", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:00cc211c-3d62-5e8a-bacb-d21d986ae32c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bf6c6e4f-1f87-5ce4-b4be-3e9b274d8791", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9317fc58-b7e1-5bf6-9b20-c3f57b5bf5be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:db034941-c2d4-53bb-8b3f-225e1884737c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:746ed179-a33b-509a-8ba2-3f28434cb77f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:afda6461-72a3-55f6-9401-6c8047587f1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:89a86c6e-de5b-5042-9f49-0eb88154aded", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:103c5db0-0b72-5f48-8686-2839d59f1181", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6e48a2b9-3db8-532f-ad95-610906f97a5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aee46d2b-42a5-55d7-ad72-d24963a88a3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0ddd9835-2f00-5756-b547-0b70507cf49b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:28f6f1dc-7cf9-535b-a8b1-ce99dee970c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f26ae24e-3b88-5c1c-a774-9326fccea8bb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-plus." } }, { "id": "GHSA-gc59-r5jq-98qw", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8d9b08f0-b7be-5f46-a121-5eb8c1da9968", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.ee8:jetty-ee8-plus 12.0.22-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-plus@12.0.22-tuxcare.1" } ] }