{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0b956579-9d0f-56bb-a65a-c6ded454f4d2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "websocket-core-common", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005", "version": "11.0.28.tuxcare0005", "pedigree": { "ancestors": [ { "name": "websocket-core-common", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28", "type": "library", "group": "org.eclipse.jetty.websocket", "version": "11.0.28" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:9ff3b62d-0feb-519b-9003-a5ebe80dd260", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:778a2836-8e5b-52c7-ac12-929463ae1213", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:4c4bd81f-d25b-5414-b8b5-7f6bf288397d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:9d1a969f-ad08-555e-ba8f-2c61363676fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:936b3cc4-006c-5f84-ad1b-ffef9ef96824", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:b7514a36-cbc2-5b5f-a13a-7fa964d949fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:fdf676d8-a6a6-520b-bd7c-70aa1e1326db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:6ab405cf-b0da-5107-be5c-147f57baebe1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:e70d4274-8f43-5ea9-a1a0-1b84fa26336d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:4c55bdd8-211f-518c-bf6e-7d1c356a9108", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:18fe19ec-bbc9-58b2-8095-5f0ab8fc59ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:6c1e15ed-38a3-584b-9c66-150fa61071f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:7b3e5a79-01c4-5826-8b27-285a1df7b31a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:c5aed633-af7d-5329-872f-dc62c6591388", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:1ce3bb23-2706-5c3d-a63e-aefc3a846204", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:d3026879-4f8c-5716-9590-d8d98f73a2cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:81768c60-1498-5b40-9633-aaaeaa54f11c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:3b1f3c47-ee30-5d87-ad7c-8acb31d4c3fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:88d5583e-44ca-5219-8935-80302bf02492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:24826289-a127-54c7-bc70-06c8c5d7b7aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2021-28164", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:092519a2-f8b6-5689-86d6-b9674a258314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28164 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:1f809196-8991-5443-bd3c-189a956f3db7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:cdc33bc5-a152-55aa-a6bf-7de1fd6a232f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:3bd749ce-c60e-551f-bf34-77acfb2978cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2021-34429", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:20d056ea-a73c-51b2-af97-fa8cc7899040", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:9771fc6a-e2a6-5bb7-9ad5-dc7860601b53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2022-2048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:32ecc284-0cdd-5b6f-8bd5-1f6749a7e099", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:7f1ae7ae-23b3-5c6e-a97b-f1172182f139", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:03b5dc09-c465-5fe7-a3b9-6b91c90dc096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:02e30368-373d-5fde-97ac-8ead2b35ef94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:33b7c59a-34db-5028-af60-ea4884ebb4e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:b7a87c8c-7024-5136-805d-4ced2ae4febc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36479 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common. Version 11.0.28 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:5d7f0c49-42c7-58e9-80bc-46a7c4e22e01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:ceb0752f-b545-5db8-8b1e-86de1b625f63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:50a2090b-2ba6-541a-b7e3-7e72e32757ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:5daf4f8f-1432-5ba8-9c84-5781c1c01878", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:0d8dd48e-c8af-5c73-84b3-e64fe420790c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:6cb94ec9-dd2e-51ae-b8c5-6fb5273edbb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:10bb02aa-586b-512e-a45e-13ad4513a3b3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:30db99dd-86c9-5ca6-81a9-589ac30d2a0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:1899a099-5298-53c5-8bc5-fb9a8c5b7400", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:2f72dfdc-bddc-5827-896d-cf0af7b8d66b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:16de3895-9dc0-54a1-b5f9-9192885fc946", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:0ee74eff-97ec-5ddd-9a06-e20942f4e802", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:0ca83779-23c9-538f-866b-772414bda9a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:d3d7d20a-8066-5938-b514-fc040664c0f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common. not_affected \u2014 Jetty 11.0.28 is not affected by CVE-2026-10051. The vulnerability describes trailer leakage in Jetty 12.x's redesigned internal.HttpConnection where the _trailers field was never cleared between requests. Jetty 11.0.28 has a fundamentally different architecture where _trailers exists in HttpChannelOverHttp and is properly cleared via the established recycle() mechanism between HTTP/1.1 keep-al...", "justification": "code_not_present" } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:e0ce4ecd-4c30-5fca-b461-8807b985aa35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:375959bb-d9c3-52e8-80a2-92d97136bc66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:7ee21692-70c2-5895-a6ec-dcaf0b8cf687", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:a7e88498-d3a6-5263-82da-bf0203b15d4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:5c666cd6-38cb-57a7-b229-c04be3a2d668", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:2dfb138d-bd9e-5416-95f7-5a05e85593b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:59216043-c3fe-5b75-9427-e10c3bf5e37a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:8b8e7eb8-609f-5ab2-b60f-009550b60f9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:5701d815-e4c9-5b61-b7c3-64242122f285", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:c76f52d3-e799-56ba-b7e3-93193540a678", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common. not_affected \u2014 Jetty 11.0.28 is not affected by CVE-2026-8384. While the target contains similar semicolon-handling code in decodePath() that doesn't update the character tracking variable, the vulnerability does not manifest due to architectural differences. Jetty 11 uses a two-stage normalization process (decodePath then canonicalPath) where the path is always fully normalized before security checks, unlike...", "justification": "code_not_present" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:cb5ffdb1-f298-5c5e-b4bc-f8d663a132a7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-core-common." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@11.0.28.tuxcare0005" } ] }