{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6ba4a960-f461-5384-b0aa-56a83267c34b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "example-async-rest-jar", "purl": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.example-async-rest", "bom-ref": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2", "version": "9.2.16.v20160414-tuxcare.2", "pedigree": { "ancestors": [ { "name": "example-async-rest-jar", "purl": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414", "type": "library", "group": "org.eclipse.jetty.example-async-rest", "version": "9.2.16.v20160414" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2" } ], "bom-ref": "urn:uuid:ef270f26-eb1b-58ea-86fd-9439aebb0b63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty.example-async-rest:example-async-rest-jar." } }, { "id": "CVE-2022-2048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2" } ], "bom-ref": "urn:uuid:e0c1e97d-620c-5c98-9873-ec0796893acf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-2048 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty.example-async-rest:example-async-rest-jar. Jetty 9.2.16.v20160414 is not affected by CVE-2022-2048. This vulnerability is specific to the HTTP/2 server implementation's error handling in HttpChannelOverHTTP2.java, where BadMessageException handling fails to properly clean up resources. HTTP/2 support was introduced in Jetty 9.3.0, and the target version 9.2.16 predates this. The vulnerable code path (HttpChannelOverHTTP2 class with its onRequest/onPushRequest methods) does not exist in this version. Exhaustive searches confirmed zero HTTP/2 implementation files at target SHA 12a5258bab9. The Brief's INPUT (invalid HTTP/2 requests) cannot be received because there is no HTTP/2 server to process them.", "justification": "code_not_present" } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2" } ], "bom-ref": "urn:uuid:460fcf32-f595-5a84-8107-ba4a2e0539d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty.example-async-rest:example-async-rest-jar." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2" } ], "bom-ref": "urn:uuid:119b376d-0a62-5297-b9b1-8e9bfe0b04bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44487 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty.example-async-rest:example-async-rest-jar. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2" } ], "bom-ref": "urn:uuid:4cc8c80e-c96e-53dc-87b7-cef0dd1fbc57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty.example-async-rest:example-async-rest-jar." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2" } ], "bom-ref": "urn:uuid:809190e5-9708-581d-a036-55596a8b713c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-11143 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty.example-async-rest:example-async-rest-jar. Jetty version 9.2.16.v20160414 is not affected to CVE-2025-11143 according to advisories.", "justification": "requires_dependency" } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2" } ], "bom-ref": "urn:uuid:4ac4f5f9-412b-55af-9669-87a7221d5c7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty.example-async-rest:example-async-rest-jar." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2" } ], "bom-ref": "urn:uuid:92572387-09f7-5927-9a7b-0a00015126c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty.example-async-rest:example-async-rest-jar. not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's URIUtil.canonicalPath() method which has a slash-tracking bug when processing semicolon path parameters. Jetty 9.2.16 has a fundamentally different architecture: its decodePath method strips everything after semicolons before normalization (URIUtil.java:289-297), preventing paths like /public;/.....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.example-async-rest/example-async-rest-jar@9.2.16.v20160414-tuxcare.2" } ] }