{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6628ad83-422b-57fe-947c-6c77a36cb1df", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee9-osgi-boot", "purl": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee9.osgi", "bom-ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee9-osgi-boot", "purl": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee9.osgi", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8a0a0598-270f-5183-981d-21c846c0c7d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fd4347fa-ddf7-5391-8fbd-c9cd96c7122a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0059c85a-7400-533a-aa33-1763789b1b49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9e75d4ca-6985-52a4-8965-2c652511fade", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:40fb4664-98d1-5298-a01b-c019d70f66a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0c1743be-fbc5-50a6-8f0c-ba40685b8cf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:650787fc-ea4d-5ae6-962e-bad17e61ecbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:82e2184d-69a7-5152-a500-1b6b5da717ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b9003d65-63f1-57e3-a161-044b250a7d3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b8b833ed-72bf-5848-a449-d7947d67e628", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:72bd917a-58b3-5bcb-9b6c-0a9be42a0e7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:30595079-d8b0-50be-a1d2-102dbe5dadf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4177226a-ae8f-5e9f-bbb7-3a400b214fda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aeb01dbd-db3d-5788-8f68-d1634064c0bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:01ab0161-6e4f-5ae1-92f3-2bb8fe7891e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a1b05f9b-b3c5-5281-b2bc-5779b8a00cd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7dfd2d41-f04a-566a-b659-19aeb3e2ff0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:15c6e301-bc78-5d72-b281-ee0350a60180", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9300350c-11e4-5504-8019-ac239dc4d29c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0d7e6686-2775-57cf-ae37-6e0a5465c6ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d2e3e464-c3a1-5172-8e81-3edf7c89f729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:54850a91-1615-5764-b4ee-5062b8a02e91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:000d79d1-7673-5f46-8ad2-1001191e1924", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7c771166-93d7-5c3b-9e52-6c8f6c7ed403", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e93f1906-e974-5722-af1d-6e2ac64f62a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:30382760-b806-521c-83a9-d1703a942e96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c7064905-5d18-52d8-bf31-51fc5a20de11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ed302c33-9f64-5a71-a8d3-4bf4c1c01950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cc87a58a-dbf4-5824-b5fb-5cc5d50b5dfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:051b041f-3d1f-510a-9d11-bab40845c1e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:69472623-bdf6-541d-b5c1-3c8c79eceb46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e79ab541-0618-5444-965b-c7fac2c3463f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5576b548-f3ec-5627-88c2-03401c0f2453", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:762c4eaa-e474-5a5a-bf76-dfdc0663dd37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fa5e7f1b-bad3-5298-82df-887a708cb04e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d51bbfd1-6409-5bfd-bb64-5258c8ddb9c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:75c45299-3465-5320-9b51-04e27f91efdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8bce2784-7d7f-53ed-af30-823ac34e87a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5b05a8a1-0fe4-5421-bf44-1e84fa2d2013", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:93bb0dc8-a85e-5408-b96c-540cb7acb349", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3cc36394-81f1-5afe-9332-36cfd7e13ca3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:10a6f805-4d3e-51a6-b983-025ab4d3ea98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6e11019b-a736-59ed-ab70-2d008e1c1000", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:392c5993-c11a-5dd5-abe7-dcbb51370edd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8695d735-df7b-55b0-b17d-0cc0d4997fc0", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.osgi:jetty-ee9-osgi-boot." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.osgi/jetty-ee9-osgi-boot@12.0.22-tuxcare.1" } ] }