{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2280e734-8b26-5b65-82cd-0805f00a1a8c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "websocket-jakarta-client", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005", "version": "11.0.28.tuxcare0005", "pedigree": { "ancestors": [ { "name": "websocket-jakarta-client", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28", "type": "library", "group": "org.eclipse.jetty.websocket", "version": "11.0.28" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:e22b37b9-fb4e-58af-9f44-03402ec3b622", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:b853456a-1db7-5536-acf0-296d3983275a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:f7d96ffd-90e1-57a6-97d8-7f354edba640", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:deefabff-d255-5f89-b864-5c245095ee8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:b4c4bebe-002b-5818-87ab-c7e72d02e026", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:a4d2deb3-3e9e-5669-ba9c-d96204546cb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:ff10f2e8-6780-5eca-a123-2f37b160517f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:835c23bc-8fce-5d7a-8406-6cc74576bfb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:3d11cb67-4774-5da1-9a95-11defc059415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:6aec03a5-caa9-57e9-bd9a-1678ff51fc12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:ed603779-ac29-5936-ba5e-7c35a4a4ebaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:969d40d0-3efd-5c85-88e6-8b1e8364c7d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:012456ab-6c21-5dc4-846d-053b9d8df339", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:c22538b2-865c-5c0e-a9a3-d5dab916339c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:f2c18b22-7388-5f97-b801-7d6e2396e6ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:1506fb96-577e-57a7-acae-eed7469c72ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:bf953e88-376b-57d9-8e9b-4b7b7e059666", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:50424a68-b262-590d-bd35-6280c4a5123c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:39a5b7e0-77c1-5bb3-920b-020509b60f95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:d8a1b38f-3164-548a-ae1d-b79e0bb31229", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2021-28164", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:4b68964e-c447-5749-9713-4c55037a38f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28164 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:75c3e261-692c-544f-a238-6993c858f7ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:938fd635-6778-571e-93e2-4abde22400b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:7c411edd-55ce-51b0-a51b-b8d2f5301578", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2021-34429", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:971a88a9-508a-5f59-8afb-772ffcbf9dab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:5712ec36-d1ef-5cae-9eef-b5f378ee3581", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2022-2048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:9711504a-d5d1-54da-92b6-f59c5badcf66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:026a8861-7682-5b01-8e0d-ee58f56b12a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:1b7972e0-741b-5659-b0a7-5dcb06cc3f1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:9ed8f222-f197-5383-9238-15254a33e934", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:2133a044-8e44-5ca0-b249-2c91eb1ad5e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:5be328fa-8118-5d3b-8974-d548aae9dd42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36479 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client. Version 11.0.28 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:c2661dae-7f42-5d32-add1-2c928790787b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:db074cf5-25f1-5e72-b7a0-a01ac7788961", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:a6cd8ac9-e34a-5a0c-885a-7e01da66fe64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:47a7deb2-cae6-5ad7-b5ec-e8b5e7b0af76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:481ffa9d-9c11-5441-ac33-9861421546ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:d1cfdad4-5c29-59c2-acaa-ad56c67df65a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:fd2a8de0-1e58-58dd-98ba-875216eb7d0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:2588e212-6b89-5661-80c0-2629bc2a4e35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:9016b239-abf5-5bc1-b6f9-0e31869648f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:4b132f3e-5d51-5c16-ac12-34f57a108751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:485e7c72-aac4-5f53-9c96-37c76d4a1acd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:55fd8f81-f8aa-5c53-b151-5c0dd49fb6a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:ac6023ea-5db4-5ace-a3e3-a1d5671be5bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:ae9dab35-932d-5a00-a23a-b25e768eae5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client. not_affected \u2014 Jetty 11.0.28 is not affected by CVE-2026-10051. The vulnerability describes trailer leakage in Jetty 12.x's redesigned internal.HttpConnection where the _trailers field was never cleared between requests. Jetty 11.0.28 has a fundamentally different architecture where _trailers exists in HttpChannelOverHttp and is properly cleared via the established recycle() mechanism between HTTP/1.1 keep-al...", "justification": "code_not_present" } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:2fc529a8-ad6b-5154-9274-28ab8926e767", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:fb198341-2254-539c-9c8e-e709a92025b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:fdd185e3-6916-536b-a45f-c309aa63c141", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:b00afc1f-0d51-5a07-a499-ed7afabf1c13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:475caec6-9973-589e-9965-81c960bc7b69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:5c8eb6c4-cdfc-58c6-8dbd-c8b2e04b7795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:833e2b65-e9d7-535e-a415-d28823ddcba5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:34cdcbae-a612-58d5-ad4a-41c754af2fd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:b0ddb2d2-fd8b-58d0-9c5b-8c052568b521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:29ee96d9-d2da-56b9-a3fc-0185c2e97937", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client. not_affected \u2014 Jetty 11.0.28 is not affected by CVE-2026-8384. While the target contains similar semicolon-handling code in decodePath() that doesn't update the character tracking variable, the vulnerability does not manifest due to architectural differences. Jetty 11 uses a two-stage normalization process (decodePath then canonicalPath) where the path is always fully normalized before security checks, unlike...", "justification": "code_not_present" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ], "bom-ref": "urn:uuid:3c589ae5-c1c1-5fa5-9621-8f7a326c3cbf", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.28.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jakarta-client." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jakarta-client@11.0.28.tuxcare0005" } ] }