{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:64ced082-f8f2-527b-860f-07e29c96ca2a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee9-websocket-jakarta-server", "purl": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee9.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee9-websocket-jakarta-server", "purl": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee9.websocket", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dacf211a-5a7f-5c9e-b7ed-4120b4efcfb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bfc9e414-606b-582c-930a-e53830eb7f90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d453ce38-53e2-5cad-a2f9-aefd21898014", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:acbf04e6-3c25-55fb-bcf1-f7863c26462a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f4aa531d-e169-5b4d-9a37-b4fb2fac8416", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a7ac20ec-2b64-5d8d-9a71-e5fa48c2a8d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8ab27f91-7910-59a9-8681-69bd1111b9ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fb4a4b1a-2661-5039-a9b2-6be317df65b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ba4f2e15-0d0a-56ec-9e1c-c2ab3dfbd459", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:801766eb-6d19-58ed-b6f9-3151bf2089d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c1b8614b-df5a-5999-96dd-1766e3bd426b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d26d67ed-ce1c-59dd-ab0a-05ca4d29bd1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e951d3b5-7d1f-5007-a748-c9c93ff20c2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:61f99f50-2488-5a9e-be89-e8486e607fa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:68bf65d6-36f4-5dff-99ec-0587b4033e1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b06f2aab-a027-58eb-bfe6-793965a824fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:12a27955-552f-51ae-b67e-ce2557b5e1d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ba00636b-24a1-53df-a51e-432ab219d845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8bea600f-56c0-5e73-9341-255f9473f8c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:49261b03-0299-53d7-828c-1db44408a411", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:de9962d5-3357-58a8-9ee4-31bf1c33ca44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:54874f06-c226-5d99-855d-52ef060b2554", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ae32fde6-6827-52d6-8ca5-45e48129b5f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d58d38fe-627f-546b-bdf8-d3bd59c825ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c17e5e75-6fc2-5209-9b23-2e166dfb9e59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3d2c9cf3-55b8-516a-9eb5-e44baae95c58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b7871a9a-4e88-59b3-9f52-3fd0f8f65109", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:79ec0465-7473-566f-ac86-4979fbc059f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e1d4b517-9063-5c79-bcdf-317b9a6c8c85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1c69c6a6-534e-5899-ba90-5a76b7ced42f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:46abe577-24ac-59b5-84b6-b4a5473c9f75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:972279a7-dd5d-53f6-854e-2bb49de7f546", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d0233d73-6b1f-594f-ae4c-1c447c94dda2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:343e5b90-dede-5e07-98c1-8dc53b143187", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:83cb16dd-3f77-5933-a690-30c3029c8002", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3c29f491-eb9e-52c1-ab05-f1f41cacceb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4ecfb433-3848-5e5a-8bf5-558bca43a6d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:345ac6c1-5d6b-5574-bf8e-42c8b4577770", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2025-1948", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:00870c5f-b54d-5a7e-85f3-4736d4b0f94d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:818d3fef-a715-541b-ad42-6c34c52fd15e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1f3ab5da-57b6-598d-918b-5c9cc6503d04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ba708c48-5641-541d-b338-9e640cf91af1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:48ae188c-d36c-5087-9b63-263adb211c9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:720a57c8-fbe8-55dd-acc7-02a496e48399", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:27094de1-10f3-5118-b979-8184f5982d9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b13b6f8f-8c67-569f-93bd-f7086f23c85d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d2b6c90a-f5a5-55c2-a6f1-53043ba3b738", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:062ecf4b-c63b-5c7a-9db9-2ae5d531d8f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:eb7e6dba-ffd2-5fff-a20f-f43d8e2d2c6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d834d89a-b70f-5926-9099-5f9655d27b38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2cc16912-a11d-5550-902e-3b5c4f821560", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c3077c29-5f28-50fc-bd83-f1519ec7fb4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3935e4da-0a46-56ad-99e0-857e620ab3c0", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server." } }, { "id": "GHSA-gc59-r5jq-98qw", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:14cdf873-c470-5a6b-bf8c-d20bb93572ca", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jakarta-server 12.0.22-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jakarta-server@12.0.22-tuxcare.1" } ] }