{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d4f81d75-1aa4-5e2f-815b-879880495abf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-websocket-core-client", "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-websocket-core-client", "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22", "type": "library", "group": "org.eclipse.jetty.websocket", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:48a313dd-6e41-523e-ae6f-b46814b3d160", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a0fb5b2a-8fb6-5483-8413-e16c7049e198", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6f23c052-1ca6-5a8b-9ede-c000826014a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2f089650-e237-566f-86b9-5f34b3544128", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:47a8722b-16e9-5f6b-9447-5945d290e6bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d56b4cf3-d839-59ed-8df8-e7b5325e97a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7e8a9203-3110-5998-be26-800e159029ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d7d8d58c-f7ea-5c1b-8348-d876c7522863", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:decd3ccc-1c39-57d3-9896-a155288a22bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e8679d5d-b9cd-5575-955d-80b31df5abb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4828bc27-21b6-5c8c-acb0-ba324c1d89b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a8bb1ea3-4ab4-5212-b303-688ff273067f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1c1fe783-da3c-5288-a8ef-ed52a84cf809", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:98065c19-33e4-5ea3-9b1c-15d3e15c518e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0ea053b8-cda6-5b6f-9d98-b479090eb9d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0b488c46-1553-5423-869c-b2ca1a788b9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8382a3b9-29ef-51f7-9fa5-a25915386e2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e5a0d461-03ba-50cd-933b-5e83c063e9f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c9122ddb-00e7-5031-baa3-48c079566ff5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:70269620-7188-5da9-a7b9-af8f4e0ff0bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b8b7b298-8734-5acf-b619-65392db6c98a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:04f4f31f-772f-58bd-8c66-b546dc8e2717", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:67e4755d-b71f-54d2-8caf-919a8fe231c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b4600cd1-90f2-59d2-becc-1c86e53fd489", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0a84b907-2108-5858-b9ad-51048ef38877", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0214f8d4-dccf-5500-9a01-6ecc5b78cfa4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f83a7a2f-2020-5fbc-84a3-b8358f58b305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c006e625-a611-5c3d-ac2b-9f8452bb6793", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fbf51e84-3145-5bae-9ded-adf069124884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6fe519e0-0c94-592a-95a6-84f4d2ba0bde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f824c9ee-2aa8-5a75-a42c-222ee58871bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8d4346dc-4686-5fe4-970f-4f1176876bcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:de3422ae-8f90-57ae-ba08-a1d2d7bfaa87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:278cc250-5a55-5fbb-96b1-8a21c6afce07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3f242035-39de-5d2f-af40-aeab3b68596f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a52d268e-3a06-5188-9eac-c9802095235c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:760d2dc4-76e7-5011-8e54-1b55d0ebac20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7710ef9e-e80e-5218-8489-b71a37bd03b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2025-1948", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6b0f9e9e-43ff-5229-bc33-b263bdc33111", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5e458f3f-c83a-5d9b-8d14-9858103af212", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5ff24981-5555-5dc0-a798-517c9364f6cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8f527cce-b8bb-5a0d-b2ce-0fb50c367534", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:23b1e65b-3b5d-5b49-8bac-e6b290b83772", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9c2f7746-31f6-5e2a-aa09-b92372822f23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6d715a94-2c11-5191-aa34-79793ae41ad3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:60d45cf6-58b2-5afa-8b98-4ee2a67a0190", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:960ab69c-99fc-588a-b644-5f38e1e96646", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:910d78d6-c923-5061-a044-5baf6ac16580", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:eaeac2a9-1a04-5c73-96e4-ec884ef7ae98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6a99998b-54cd-5665-a37d-14c914afacbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:81aac4fe-f911-5a7a-92e6-bb0616477eea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b99e9f81-df87-5e25-8953-68487ff7f024", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6b6171a8-9f98-5308-b165-4e709e0f30ce", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-client." } }, { "id": "GHSA-gc59-r5jq-98qw", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c47f416b-7354-55b4-8197-c627b33a4c25", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.websocket:jetty-websocket-core-client 12.0.22-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-client@12.0.22-tuxcare.1" } ] }