{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ebac5435-a512-5673-9f61-c6ec078e66f1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "jetty-ee9-home",
      "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1",
      "type": "library",
      "group": "org.eclipse.jetty.ee9",
      "bom-ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1",
      "version": "12.0.22-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "jetty-ee9-home",
            "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22",
            "type": "library",
            "group": "org.eclipse.jetty.ee9",
            "version": "12.0.22"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2006-6969",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3060a1e8-eab8-5cd1-bca0-d6ce33abf9ae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:719a66ff-93cc-5905-8d87-3f636a0d519c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b6d2a81f-fa27-5ecb-8c21-67bf45dd17e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2011-4461",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:85889895-7040-5701-beee-a83e25911cae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2015-2080",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2a4790e8-4126-52a1-b5eb-03a0e297a0bd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2016-4800",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:78242c48-ec2c-5fb9-b50d-e7d0c3592ded",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2017-7656",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:72017f39-9fca-5d0e-8cf5-58f7239ab6bc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2017-7657",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3f55c29f-6886-5dc1-a75b-02d47bca1a33",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2017-7658",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a5d97ab7-d18c-5caf-a767-540a16039950",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2017-9735",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:96ffb5da-1d31-52dc-a552-bcd118a908e3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2018-12536",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ed98f6c0-20b2-5ce7-96d7-8abb39041bf4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2018-12538",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3e36dd0c-0538-5444-954a-a18edecbc97e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2018-12545",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9a9ef99c-63b0-5808-80a7-0070ae4eee09",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2019-10241",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d99f0370-129d-5e9a-9b0f-7ab9e4a35de2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2019-10246",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d85adeab-3b47-5c81-8bea-ea6c5e946ff1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2019-10247",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:99f83f6d-d0dd-5d3f-b4fb-4562e153a15d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2019-17632",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:91b82462-9329-5216-af76-1bf577503ff1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2019-17638",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fd2e167b-9aa8-5478-ba2e-8ffdb979ca28",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2020-27218",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:57d4d6f0-76bb-5b1e-be86-d327b2021256",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2020-27223",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:09f6b286-b87c-532f-87cc-b4e822be5b73",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2021-28165",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1bd03d68-516d-56b2-ae8d-4db60e0ae019",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2021-34428",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:32b8650b-8a87-590c-93bc-5cf07cae6ae9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2022-2047",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:331be49b-8a5c-5ac2-a8e3-368927c6eebb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2022-2191",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1ecf79ef-b1a9-57fb-b4e4-411e8b979d1e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2023-26048",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6829dcc3-1368-59c7-bbc7-ad39a098161b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2023-26049",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5156bf43-bdbb-5245-8108-e41c926fd423",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2023-36479",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f164dbf9-4f73-5a82-9d26-dda92cf30210",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2023-40167",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:70da284a-3ec6-5a21-9a11-bddb5a7a2b1e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2024-13009",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3e86bd33-7e0a-54fb-805a-497fa59bfb8f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2024-6763",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bd2d790b-edb0-5111-b763-d1360794041f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2024-7708",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dfc1ef90-c4f0-5ce6-81df-b857aaff99e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2024-8184",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a62b0d35-6f28-5c04-a643-980da95b417a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2024-9823",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f8ec8891-e00b-5224-8e78-8f83af2d484c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2025-11143",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0b092ef3-989f-586d-a0dc-e030fde0b037",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-10050",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:29e6e15b-6b15-500b-aa19-e443cc2fee01",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-10051",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bb38ff2a-dab5-5dba-b71c-9ed3651d3eb6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-1605",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:02bea8ef-e371-554d-839f-0a3f87e11d38",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-18659",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:90bd5a74-0f19-58b6-bbb9-803cd87390e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-18660",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:191d4bb1-ece6-5e44-b5bb-2ccae79be69f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-18661",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8f03cb4a-8026-5060-9321-69bf32ff5bcb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-18662",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e65d0672-3ac5-5182-aea6-18aa9fda4d30",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-19864",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:85c381ec-23d6-5e4a-9459-c04b1aa7a3e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-2332",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ef41d4a2-1be2-56fa-b3dd-abff5349618e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-6790",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b58baccf-45b5-5ce7-b7ce-69b4db80d31f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "CVE-2026-8384",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aa3cab18-53eb-5f5f-bea5-d2f978ce29e2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    },
    {
      "id": "GHSA-58qw-p7qm-5rvh",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1d97ed34-26f0-5e45-91c2-3b9e98622cf0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-home."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-home@12.0.22-tuxcare.1"
    }
  ]
}