{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aecb0784-d938-5b01-83a0-b0d1076871ea", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-websocket-tests", "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7", "version": "9.4.58.v20250814-tuxcare.7", "pedigree": { "ancestors": [ { "name": "jetty-websocket-tests", "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814", "type": "library", "group": "org.eclipse.jetty.websocket", "version": "9.4.58.v20250814" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:08356120-3849-5c01-a1a8-516bad0a181f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:dd00cc32-153c-5d64-a408-ad7abdd113de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:c6a61934-237c-5d6c-9d4f-a7ae5ffe2271", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:3830652b-73c5-591a-90b4-db4c9c562bdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:b5e0cbf2-6e9d-55e7-864c-5762b8d6fc7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:504ff525-0a90-5c51-a68a-f9260b6cdae0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:448445e8-a2bc-5569-9b1f-7e95e0d3fd04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:110981b5-9b0c-5f0c-854a-c9c59906f299", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:d8553d4f-509c-5931-a98e-0828c48400c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:02f295c2-c8ab-5434-80f3-e1c671a25a10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:00bc8a63-7ebb-5d8b-a1c6-1b00269cfa8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:c4ca2968-5926-55d0-91e1-51116d080ff5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:9d296568-f137-50b6-af5b-431a751019c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:66c9b4a4-6e24-5154-960f-a25f277ab758", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:ba5320e8-e70d-5ddf-82d9-cc8612413af3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:27a50b4c-385c-5244-9e81-32b12b3bc82b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:39e2830f-1a0a-5daa-a404-ee5eb5244300", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:6afb493b-99c5-58a2-b310-f8e4161d793e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:c79c1268-48fa-5c68-aed8-0a30c1fc0cb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:9ef9c290-4525-5f42-9c90-f91f22649102", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:9a4fb83e-46bf-5290-a9a4-e8935437e4fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:53aa23d3-5d6a-58e0-ab06-bda7a615c936", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:1ddd8cdb-f9cb-5691-9a40-440749e47894", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:b1003088-ed3e-5a8f-93d0-3ca7b2131541", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:0c78763f-2160-5891-bce5-4dd4bf98bb32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:09bfe567-571c-56e1-8220-3bf86e4518b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:dfe723cc-e057-5c23-b161-7d5a937331f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:4a1d7877-19d0-5ce7-a65b-dc2cedf9527a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:922c19ad-5137-589a-84fb-2e2550705274", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:051daefe-2e00-5211-87bc-529e755fecca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:84a87498-eb3a-5527-87a7-e1a0b0dd0f75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:b6693d44-64f6-5ce4-a4b6-052c257bdd7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:a6f2bab1-7fe8-53bb-817a-f565aaf35d8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:7333bfac-76ae-5350-a792-5635678230e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:497cace2-039a-5127-9229-dce46d99ccc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:7b1a7ecd-50af-507d-9844-0b29b42d95ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:666b5ed6-bc8e-5e77-9e96-58edc0159251", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:a600ec01-427e-5cba-8e11-4c58b2dc2b4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:562bdea0-1b8c-568f-965c-1f52e9b1e1ef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.58.v20250814-tuxcare.7" } ] }