{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1fec03b0-e543-57b4-a9a2-2abbe268ca0b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "jetty-websocket",
      "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1",
      "type": "library",
      "group": "org.eclipse.jetty.websocket",
      "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1",
      "version": "12.0.22-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "jetty-websocket",
            "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22",
            "type": "library",
            "group": "org.eclipse.jetty.websocket",
            "version": "12.0.22"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2006-6969",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d18fa46e-995e-580f-866a-38e6736ce502",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2a5bca2b-fd5d-55a9-b3dc-9a83594fa6d4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:83ae4f71-223a-57d6-9f56-f62f3315265a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2011-4461",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:03f153c3-7406-5be8-b6f1-af63d1639965",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2015-2080",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b8a711ae-dab1-5dc0-a692-bd7983b67536",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2016-4800",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c9c3fec6-430b-5544-8ca2-e812b43e953f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2017-7656",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f877c12c-55d3-58b1-b8e3-f692ee6d0124",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2017-7657",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:029e79eb-7cea-5d79-8519-08602703634e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2017-7658",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:98907f67-ed7c-5b40-b125-a89c777b50cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2017-9735",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:74cd8aaf-6f44-55de-bbd7-dfd9cefc3b76",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2018-12536",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:813a22ad-c940-5a3c-bd5d-fb808e484917",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2018-12538",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3aa2ba57-2ea4-519d-b85f-ea35d766e0e8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2018-12545",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bcece2f4-28c2-5c26-9d11-004c6fbb2059",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2019-10241",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2e236624-639e-55a6-9378-683ca0d5f187",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2019-10246",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8b7326a6-e613-52d3-b849-a490cdb1303c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2019-10247",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d92328db-f284-5f5d-9554-974c666b6838",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2019-17632",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:114689cc-8a17-5fdc-87dc-1ac9a6001e8f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2019-17638",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5ee77064-c9ef-5ce5-bd13-59108ecd79de",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2020-27218",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bcd705f9-bde4-587f-bb8a-7ad34930a220",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2020-27223",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:afa3eade-df33-5be1-b31f-6f24f9dd4f5e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2021-28163",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:55582a71-225a-57f6-8d71-2312899a2b3e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2021-28165",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:29447659-6766-5b9a-97fe-2cb1550ca00a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2021-34428",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f1f57bd8-cc36-57f2-aff6-123130ce8c05",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2022-2047",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ddbcd738-b7e1-5d5b-bfaf-b70a4d651c49",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2022-2191",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:975ed4d7-cc95-5e11-88b8-b32687bc891d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2023-26048",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bedfb34f-39e5-50a9-9c01-f6f1072d8806",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2023-26049",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:af78981b-25a0-59bb-98c1-aadbcc2709b2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2023-36479",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:81cab658-35e6-5aea-a70d-34a79474d402",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2023-40167",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:16aa96c0-a481-5a50-afec-8016fbfe81f7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2023-41900",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:48cd8154-e86e-558e-a62c-4ed48f1ebbcf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7b762608-3c80-5eb2-8810-793c5cc2002e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2024-13009",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f9822627-e0be-5fa0-b93e-d3f9b4f243b3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2024-22201",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f70d08cd-8621-527b-9fcc-9560c2df2503",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2024-6763",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d89ed886-5762-5b86-927f-07cb65bee55d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2024-7708",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dcebc834-45a2-5415-b7b2-fed4c38682dc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2024-8184",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7f4d3a89-4ae2-5ca4-addb-e9b10263de50",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2024-9823",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:34a16796-9726-5f9a-84de-2aa96b1eb1c2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2025-11143",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:94e85e10-872b-526f-963d-e75772649dea",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2025-1948",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fc891764-d918-557c-9b36-e5d7aaa131c1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2025-5115",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6e8a5392-3a33-515d-97e0-d2e32eb14d1e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-10050",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f2702b1a-162c-5ac9-95fa-0b50df8560d7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-10051",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:46116a81-ffd3-5205-a771-2984e267e438",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-1605",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f42ea5a7-0e46-567c-b003-0df8d77e679d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-18659",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7f1ecb41-9e3f-56a4-89d7-ba41bd7a7d67",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-18660",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1ac8a663-aa45-5d3b-a30b-c666efad03ba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-18661",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:baa76ce9-30bc-5e55-a75e-960ce2613f87",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-18662",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2998716a-dc3d-5acf-8155-93001d7adea9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-19864",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2ed6c4ad-ee05-5c81-a150-f663e3866c33",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-2332",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:61812c95-e575-5319-9fd4-01595038077b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-5795",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f9cdce85-9b6d-564e-83ec-0f2d0c843fdd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-6790",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6bb40b06-a632-5daf-8804-48cca61ac80b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "CVE-2026-8384",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e4004b34-97f5-552d-8b22-c44362be37b5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "GHSA-58qw-p7qm-5rvh",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:44743f7f-e22a-522c-aba1-d0675955948f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket."
      }
    },
    {
      "id": "GHSA-gc59-r5jq-98qw",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f1534674-6ada-5f29-b2e9-32a7fdbd7916",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.websocket:jetty-websocket 12.0.22-tuxcare.1."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket@12.0.22-tuxcare.1"
    }
  ]
}