{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f59b0dce-d649-532b-9700-ff5ad08b1469", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-websocket-core-server", "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-websocket-core-server", "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22", "type": "library", "group": "org.eclipse.jetty.websocket", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:982d3118-49a0-53a9-9fb8-00647e6d32a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3aca12e4-74c8-5fd9-aef8-d667a9fd8361", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5e71c59e-8a4e-5883-ad1c-142ad944763e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:96ad4d15-2b72-5796-beb3-e5b7eb2761cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:601622fb-3326-57c9-ba17-00f4f33c249f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:feac6cf2-f254-596b-8bb0-1078febf938a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aa9edea2-2643-56be-9b8a-299bec50b479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:97a63fa3-7123-54bd-8be1-ecc6a4276f34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:757ceec7-c8c2-5987-a5b8-7292bb1a875e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0e75abcb-5bd0-5ab2-a76b-7a0445252501", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ce85c659-1bc1-5aad-9900-3e08e4005d26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b7b6538c-af93-5dda-a521-a39de03b6651", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1ed4e537-a9b0-57a0-abe3-2733aef9ec28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4ea4e1c9-da7b-583a-a962-0d1c6fb786b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b385ee6b-6a42-5d7a-9ae1-18a85a9b1fe5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c8733e9f-82aa-5419-a4f0-e456dc487f67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d8a23964-de09-5049-9b2a-e307fe5a16cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5f0b1228-b1b9-5297-ae56-09f3e92c1565", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3b2e44a2-f414-5a39-943a-82f1bd285aa4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aafb4cdf-f5de-5a91-854d-153a5cfe954a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aac11a80-e526-5d79-959c-8d7d2ccaf793", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5658868c-a3bc-570d-93d6-3c2854cc667d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:acae62af-6b39-56ae-97b1-fe2510810d9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:21886eaa-b00c-5449-aabb-cfc1630b36a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:07a21397-3177-5d63-98f1-9b94b782fba2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2c14c5e5-e0cf-555c-8d78-5854f950c002", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d466bdad-6e12-5939-abfa-42d3eb5af2a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:df9a6302-0b8c-563c-a0c2-262392367a3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:891e8cb7-ac84-5e01-9839-4863f70ed7c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b184d817-cf31-52d6-afbd-4020903fb97f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b305ce98-d299-5fc8-832b-b1cb0960b3dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dd4c7bc6-b348-5fb8-bf62-9d4ae0e51e63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b087e142-337e-51e4-935e-e28fb1fb988b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4d58cdf5-b8ce-52b0-a051-fde1db6f3a5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6b910e66-2cfd-5286-b7a4-32ec6e3a2c77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e215788d-2638-59b1-b01e-3c159ba830a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9a28e902-b564-584d-a90b-fa1fad07f79f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:708f1e3b-8f60-5097-8fe8-6ddeb039e4a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2025-1948", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2cf92898-3110-519f-a798-8951d01501d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ab5161b1-9bfd-5033-9d85-749980c40f00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7a4c3efb-3521-5109-96c7-1aa45f9ba65f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bce7db8d-8885-5f22-8657-6226bfc01962", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d869b306-3ace-56e3-be1b-78ec7507486d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7227be4e-36b3-5cfd-87c6-e34ae47bc41f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8f669d45-4822-51db-b90f-349a54c730c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c18f5230-37a1-5ce0-a4f2-701df67ac881", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a414f1d6-0627-5b2d-b733-456bd11b750a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d8417dcc-f545-5dbe-abb7-438896f91676", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8d7300d9-a707-5daf-b552-637d679bfbbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:88802f72-71e3-58c7-8298-76c8f56759ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4884665e-b9e5-54e9-8af2-f21f7e3a0a7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:63fc9f7e-17d7-5ff9-9ffb-88c9b8102ac2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1d96e976-1102-56a3-976e-c50f14bf11c9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-core-server." } }, { "id": "GHSA-gc59-r5jq-98qw", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:66f14095-2d3b-57e5-9344-82ff9a25082a", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.websocket:jetty-websocket-core-server 12.0.22-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-core-server@12.0.22-tuxcare.1" } ] }