{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bf10b603-e50a-52eb-9f36-c83322d5c552", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "websocket-core-client", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005", "version": "11.0.27.tuxcare0005", "pedigree": { "ancestors": [ { "name": "websocket-core-client", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27", "type": "library", "group": "org.eclipse.jetty.websocket", "version": "11.0.27" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:7f38144f-2063-5546-89cf-282fc23dd228", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:d349424c-c0e5-577f-94db-216a3309f170", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:9ec9e23a-5fd7-57a2-925e-92a515f3af01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:fedb8be6-6995-558f-b28e-bd0fc858c8b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:380e9506-e5f8-52a1-a679-51803f36efa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:04f0f55b-6f73-5319-920b-52ec17aece70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:edc62281-c216-531e-beab-467784f52ea7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:0dd887f6-9444-5920-8c0a-cdea03a511eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:826589c0-d359-5a06-aaa3-cd1073a2cee9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:16f26cb4-47d1-5662-96d8-392446dfb6b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:b677ccfa-1559-5e79-9b9f-fd1c40aa0cfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:75db07ad-188b-5c92-94fd-ebc6018b711f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:2f529e08-8acc-5d13-a45e-8ba5a44db307", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:c9258577-e832-5f1a-a830-52f4acd4c2ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:1e96bb1c-fa8c-527d-86f9-ef032c968aea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:4a141fd0-90b1-5fe4-90bf-b5e3b32dd9ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:9b4726c4-fa84-57e2-93c4-f52eea184766", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:012fee05-fd93-58e9-8ebe-40a6f1a3e723", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:7f4c2c27-879e-55b9-9e3b-720abd729e2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:28e6da35-0a65-5283-bb43-5bfc19ed8a0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2021-28164", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:8976a63e-5741-554b-93b6-8dca7a19be85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28164 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:5e1ad876-c2c0-5f1d-88d7-a389bd1ab58a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:3c2d6f98-623f-5938-8130-28f3bff2de61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:2dca2984-06d9-53b3-b1fa-824ab36334ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2021-34429", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:e6e0cc3e-875f-507b-b137-f4f05750f7cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:b7a50e5c-8a82-562a-92a7-e5ea5a922e1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2022-2048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:b512ac58-3dcf-5d96-9358-af83a0d6560b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:c4dcd1ce-4818-5fbc-a2a9-e4e55614bed5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:a90e12c0-0b9a-5541-be22-61d1d5ddd945", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:d38b420c-80a7-5796-8987-494a123cb2b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:8406ecf7-7ac5-5d7f-88b4-b587c783f3a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:056751e7-bd9e-510e-8293-991831b26fb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36479 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client. Version 11.0.27 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:d90c065d-198b-5b7a-9f4e-57a935cd848e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:cde41df8-635e-58a7-94be-0735c89cbef3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:67071222-9b2e-5d4f-a3e5-980f399e8446", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:3e81735b-17b3-5b23-9fcc-4465a8340702", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:adb5e39d-3818-5827-8596-c4e581723b5a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22201 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client. Jetty 11.0.27 is not affected by CVE-2024-22201 according to the advisories", "justification": "code_not_present" } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:f8dfe84e-876e-59bb-be42-2207047c2759", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:7cdf0473-3063-5d29-b3f6-357bc3dd92a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:3b8249f8-43ac-5281-b9d3-1200830fecde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:f5f79adb-953a-5f20-be02-b3cbcc97e843", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client. Version 11.0.27 is not vulnerable. Summary: The target repository already has the CVE-2024-8184 fix applied. The ThreadLimitHandler implementation uses atomic compute() operations with reference counting, preventing the memory leak vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:a12f3e26-13ca-5fa9-b3b2-1280c2a86212", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:c240d891-d1c7-5dd2-a58f-95a595c7dab2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:70e51ccb-b601-54c1-866b-4641fa7095b0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:84dd4562-32eb-588c-9d33-8d0998283551", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:090a4e75-fd2e-5174-ac2f-ab23ed3be1a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client. not_affected \u2014 The target repository (Jetty 11.0.27.tuxcare0004) does not exhibit the vulnerability pattern described in CVE-2026-10051. The CVE describes a connection-scoped _trailers field in Jetty 12.x's HttpConnection that is never reset between requests, causing trailer data from request N to leak into request N+1 on keep-alive connections. In Jetty 11.x (the target version), trailers are managed by Http...", "justification": "code_not_present" } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:cb211757-ed10-579d-8b8c-9ea2d248af08", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client. Version 11.0.27 is not vulnerable. Summary: CVE-2026-1605 does not apply to this Jetty 11.0.27 repository. The vulnerability specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), which has a fundamentally different architecture than Jetty 11.x. The vulnerable code patterns and files (GzipRequest, GzipDecoderSource, ContentSourceTransformer) do not exist in Jetty 11.x. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:71231d69-2f06-5f7a-b8d6-28ba035f762b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:35861883-f12b-5e0a-8b62-6ed81bef6cc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:9f6319d1-88ca-51f5-b15f-e76d054c0e42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:6b97c721-957f-57a8-b879-dd1e2327d65c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:3df79429-8179-5e02-99f2-c08a5ddc00d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:14bc7b22-ab65-5a20-b63f-e93afc839b46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:fb28a282-2292-581f-9be8-7d069cba261e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:2fc15f25-ed49-50a5-9f67-c7f15caee9f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6790 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client. not_affected \u2014 Jetty 11.0.27.tuxcare0004 contains an upstream-authored fix from commit 5f25f5b389d (Feb 2023) that validates Host header against :authority pseudo-header for HTTP/2 and HTTP/3 requests. The defense rejects mismatched values with 400 Bad Request before application logic executes, preventing the dual-host-identity confusion described in CVE-2026-6790.", "justification": "code_not_present" } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:ddfe44bd-3351-54cd-99cb-a7b7506f8e73", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client. not_affected \u2014 Jetty 11.0.27 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12's integrated URIUtil.canonicalPath() method that attempts to handle both semicolon parameter stripping and path normalization in a single pass. Jetty 11 uses a two-stage architecture where decodePath() strips semicolons and canonicalPath() normalizes dots as separate operations, preventing the bug from manifest...", "justification": "protected_at_runtime" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:e88339c7-89ec-5801-9c7b-1fb58e56e19e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-client." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-client@11.0.27.tuxcare0005" } ] }