{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a1ddd21c-d4f1-5730-89ce-7931b4066600", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee9-websocket-jetty-client-webapp", "purl": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee9.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee9-websocket-jetty-client-webapp", "purl": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee9.websocket", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c953dc66-65f5-5011-bc11-3d550645b339", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dbfa3de7-10c1-5c17-8962-7937fe3be854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3cd95924-b43e-5987-95a0-080945c8b95c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cbd72d16-9bcc-5f9d-8efa-b5cd926a302a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dfe78fb3-6b14-52d0-ae22-53ce93bc5f11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:97ed03dd-618e-575d-8bfc-906482679e14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:72d71ddf-1d82-5fe4-adb9-2ff826dfd1cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:90f28968-c701-53a1-a6d6-c610b823e276", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ac71855f-378d-5583-945d-3d5682089ff7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:93d05658-b2c8-527c-88f6-bd591b331123", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:edf55434-99f0-52cc-92d7-b84e37c6120c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b16c438b-7283-5945-871e-a93aab1f13d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cd6ace2d-c684-50b2-914e-9c4305c64c2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1bc83a9e-2428-5e9e-be30-6746a819e95e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c5e19f99-b5d5-5030-8cd1-ffb7623eb69e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b0c3aeb5-6f2f-5b8a-98b2-f7e7428398a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bda62fbc-0662-598b-89b8-76586ceb3519", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:87a324d3-d4f4-53b2-9fac-704f016a3a49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4f449cc7-7e4e-5b40-9a39-09e27b66086d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:24a6bf54-9143-5eaf-b562-db42350d1338", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c2aa66ad-2214-577b-9d27-c333b2679846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:92f97621-5c5e-5caf-9301-06e512e5f9d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:db19790c-8b2d-568c-ab58-a89e9b3c03d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0678c442-20e1-53e6-8578-a1e6306e0b3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f8c4c817-da9a-5e47-978e-7c4ccada9ae7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ef1385ce-d52a-5f0a-a63e-72683669e84f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2dadcf3c-794a-5235-ac01-c756299b5bfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:addc0a0b-80fb-5264-b221-05aaa9ae2d41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:328f0b69-5614-54a2-b669-4c10789d86a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dff8e9c3-e53c-59d7-acee-440d7f5b2e2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a13a23ca-ac76-598e-9ae9-a50b926b8751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cde3790a-c15a-5690-a782-802e4adf8063", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1355d8de-fe6c-54f4-8292-4218bd225e66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9a3558c9-dac2-5975-96fd-8ef113e7acdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:46232e5a-09a7-56b3-86b2-aef0aacb5265", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:59daf01d-3a1b-5d43-af48-dc9af1fcf693", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4308f90d-0ad7-57e3-86f1-209b26ca28e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f2ce4f13-393e-55e7-b877-5004bb3478f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:06839768-c227-5626-8f65-0049df67f640", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:68209e76-4844-5f4f-a424-82c6c362b784", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3dcb5291-b04d-503e-9536-5a88f0617358", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:89e04e0d-764f-5589-8a3d-db5bfc5330b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:12e98ada-5209-53d2-a136-5aad59c62330", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9.websocket:jetty-ee9-websocket-jetty-client-webapp." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-client-webapp@12.0.22-tuxcare.1" } ] }