{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d7c1772-fda3-539e-8efe-47ab6bfef550", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-memcached-sessions", "purl": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.memcached", "bom-ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1", "version": "11.0.18-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-memcached-sessions", "purl": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18", "type": "library", "group": "org.eclipse.jetty.memcached", "version": "11.0.18" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:77bdd5cf-75b2-5ded-a377-62508ce19dce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:365edf74-19ca-5c26-9875-68b4adca0a0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:64153378-cd3e-58ba-a9be-22ed8d0ba04b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:effb3ae3-432b-5433-906f-59e7ae2fe774", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:ce32576f-aefa-5628-9f3e-7d02d4fc660f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:47407cee-ed6a-5930-b700-bf32f86d15f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:6ae46381-7065-5d16-8b35-566a66d56f79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:4a431c83-d893-5ab3-a9a1-440f73d24c17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:0966ac8a-b029-5f66-8dcf-cc20b9a0a7ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:28c805bf-08a8-5f22-a5ea-2d453efd0f81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:d13ae872-d461-52f6-8aa4-cc22498b91ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:beb86f6d-8a4e-573c-8c1b-cf5546ba205c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:5cbe1cd6-680d-53c4-9c3f-0f5d3e495ec5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:760f586b-ef09-5abf-a177-573d8076bce6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:a10f9163-fd79-573d-8e74-54fb139e325a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:e2fa0391-1569-57d4-9184-eb0302d5adf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:2fdd322b-0eae-54ec-bea6-1063a346d256", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:aa3166ed-424c-59c3-8142-704daad3ad8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:d9df9b47-6df5-5242-845e-e394778e3622", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:e0069ec7-8350-5274-acc2-7b5ff7f397eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:d913f3b8-bc7f-5eaa-81df-e56794c1ccff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:ea9a99f4-a907-5c05-8b2e-e89787f4ad87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:c5b08780-487a-5a2f-840f-c2eb4bf60952", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:6e1e4892-ea00-58bc-99a0-51d302e57c51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:9f3ad5e5-37c3-5f03-89b3-7ee6e005a606", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:cfc7bfc0-62a1-579b-bd9b-cf4d40056e3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:ba78ec65-e687-5e5d-96ae-05c2bac99f90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:1d0255d8-3069-5ab5-8e82-60ccc2e240f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:5987ce32-eb44-517b-8cc2-04b3d93457c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:3942b55c-239e-59b7-b8ce-a1980405593e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:47970a86-17a9-5136-9255-dc9b0f4671b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:57f55256-4d8a-562a-9d01-d82bcd612951", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions. Jetty 11.0.18 is not affected by CVE-2026-1605. The vulnerability exists in Jetty 12.0.30 due to a specific architectural pattern where GzipRequest.destroy() is not called when only request inflation occurs (no response deflation). Jetty 11 uses a fundamentally different architecture: GzipHttpInputInterceptor handles inflation independently, and its lifecycle is managed by the HttpInput recycling mechanism which ensures destroy() is always called when request processing completes, regardless of whether response deflation occurs. The input and output handling are architecturally separate in Jetty 11, eliminating the conditional logic flaw that causes the leak in Jetty 12.", "justification": "code_not_present" } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:27f5696b-5820-5f6a-a09a-a820ba93fcea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:b8395b2a-3855-5619-b7eb-3ef112414b81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ], "bom-ref": "urn:uuid:9d9d513a-c982-58e2-8f0b-340131936de9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.memcached:jetty-memcached-sessions. not_affected \u2014 Jetty 11.0.18 is NOT AFFECTED by CVE-2026-8384. The vulnerability is specific to Jetty 12's refactored architecture where URIUtil.canonicalPath() was redesigned to handle encoding, semicolon path parameters, and dot normalization in a single method. Jetty 11 uses a fundamentally different two-method approach: decodePath() strips semicolons first, then canonicalPath() normalizes dots separately....", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.memcached/jetty-memcached-sessions@11.0.18-tuxcare.1" } ] }