{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2b5bd95c-1bdc-589d-ab8d-f1cafc86af2e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-gcloud-session-manager", "purl": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3", "type": "library", "group": "org.eclipse.jetty.gcloud", "bom-ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3", "version": "11.0.26-tuxcare.3", "pedigree": { "ancestors": [ { "name": "jetty-gcloud-session-manager", "purl": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26", "type": "library", "group": "org.eclipse.jetty.gcloud", "version": "11.0.26" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:902a9c96-30c7-5129-b4e6-82a78a65b27b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:b26ef282-4077-5800-bcc8-71bb9ee47b4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:5a7846d0-9817-55a1-975c-a744e8cdb96c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:957c9057-e218-579f-8fef-b1f66de29ff6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:ad679ad8-2e19-5688-b255-00335af39a5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:f7553810-41f6-5f18-8515-15b0f4950b9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:ac1d2ceb-4234-59a6-86b0-53f5ba3dea07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:6e7692a1-70e9-55af-aed8-f9b8f7864a26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:df9d8405-047f-5819-adde-67a0b90fa19f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:297d27eb-1284-5b3e-a1ad-d197e932b39a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:14bb8c66-091e-5d18-acce-c620bbbe0982", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:6a5148ec-109c-5d5f-a957-a06a116827ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:54075916-295c-5694-ad7a-15fee5285470", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:e3168564-5a3b-5ac5-82e0-bd3e14f3048e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:e2a35f02-e293-5bac-a3ff-9ed2389917e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:b6a7778b-daca-592b-8eff-45696ddf7ae9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:2cf3c2a0-2af5-56d2-8884-c7a175a1a015", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:a3cca3dc-eeaf-5545-9999-602ff250ecc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:8eea4a62-180f-5069-a80a-b1317dcc0914", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:5cfa6641-485b-5d68-96cf-b77bf605a8a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:0870c7bd-200b-53be-88f5-45ac12682355", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:0f3cb7c1-2f9d-5160-ae2a-a8361310a43c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:8b3b0712-3bc6-5a2c-8207-e642be347cf0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:4b288640-ad86-596d-a0a3-1a419511e620", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:d85724d1-07cb-5f29-a040-d9d8a7b74fe9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:97acfb76-1a7b-5762-9daf-d21e2ed3fc4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:cc89e79a-2544-5e8f-a746-aaa069bd608b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6763 is fixed in version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:4cae59f8-fbae-5e76-9a53-6356a3dfd4ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:0a45900a-3017-5b1f-9308-e5b4ee261a4f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager. not_affected \u2014 CVE-2024-8184 does not affect this target. The vulnerable pattern (unbounded growth of the _remotes ConcurrentHashMap in ThreadLimitHandler) is absent because upstream Eclipse Jetty already fixed it in version 11.0.24 (commit d1a9ca11563 by Ludovic Orban, Aug 2024). The target is based on Jetty 11.0.26, which inherits the fix from upstream. The current code contains reference counting (Referenc...", "justification": "code_not_present" } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:12c4bc1b-f837-56c2-ba2f-c5011fdc466a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-11143 does not affect version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager. All 1 patch commits already exist in target branch" } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:a01b0e1c-1e64-5fd6-866f-f81dc7560784", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:134be1ff-1cb6-52af-b65f-54be6ae5dd6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager. Jetty 11.0.26 is outside the affected range (12.0.0\u201312.0.31 and 12.1.0\u201312.1.5). CVE-2026-1605 affects the Jetty 12 lifecycle where releasing the request Inflater depends on a response compression callback. This code path is absent in Jetty 11.0.26, where the gzip input interceptor is destroyed during request recycle regardless of response compression. Therefore, the vulnerable resource retention path does not exist in this version." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:6c11ccec-8cd2-5b71-8dbb-003617c204e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:9f15d7bc-255d-5b81-866b-e896a6da94ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ], "bom-ref": "urn:uuid:592b3a88-e520-5f49-9d1e-17fd39da1d59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.26-tuxcare.3 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager. not_affected \u2014 Jetty 11.0.26 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12 where URIUtil.canonicalPath() integrates semicolon path parameter handling with dot-segment normalization and contains a slash state tracking bug. Jetty 11 uses a different architecture with separate decodePath() and canonicalPath() methods that correctly normalize paths containing semicolons.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@11.0.26-tuxcare.3" } ] }