{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5d32f78b-3c3e-57b5-a16a-dcb78ec78196", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "websocket-jetty-api", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005", "version": "11.0.27.tuxcare0005", "pedigree": { "ancestors": [ { "name": "websocket-jetty-api", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27", "type": "library", "group": "org.eclipse.jetty.websocket", "version": "11.0.27" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:ce68552e-36e0-501d-8813-1d78eb5a8148", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:d3f43668-cc89-5138-b56f-c8e287b41d63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:9a94f6ae-bf3b-5a91-94ea-06c6c108c04a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:6c7a81a9-19d4-5f25-b5de-deaf93dd59af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:cd978d08-ee57-5182-a709-38f54ea18faf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:a5000520-8290-5807-aa8f-8cfadd52f39f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:b192ce20-ad53-5b9c-9870-4d9c2238edf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:f2d09f5d-a733-5b7c-b75d-4c02081c0af7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:730210ec-9abe-52d5-ba31-dce07d84deb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:424b1e61-8ac1-584d-8ad7-40bcaec5f68d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:4197aff1-26b0-51ad-8092-1f2db215756d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:d5fdf6b0-78aa-51df-8deb-4a63f4a1ef26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:53ceca60-c65f-57a9-a728-9e9f4e00d9d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:5355e1c6-cb8a-5e4d-9cdd-8fcd22a852e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:b801f031-6a3b-51d8-9ee8-0df43dcee046", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:d2a81cbc-b984-5b32-bc25-1d069b57a17c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:a46675af-4c5e-5d6c-b763-affdda81f224", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:9c9ab84b-957c-569c-ad80-eeb1569e913b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:a72f654c-5249-5ee6-9086-f9650c05bb5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:51ab8813-eb36-5455-aa6c-302b5feccebb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-28164", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:a5f6f57e-e441-55b0-a51e-f48d20a461b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28164 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:73335799-90fb-5328-a51d-d26d270535ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:1ae302ec-1223-57b3-a31c-96979213fbfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:213f3716-4fb6-5ec1-8ad2-3ee616d1ae9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-34429", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:595709e7-8824-5b7b-a9aa-1e0dfa22dc3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:27915887-5cc6-571a-9715-0581f0a3c8f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2022-2048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:16b8ca48-0a0e-574a-b7f2-2f284d5d04d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:92dfd702-d229-51a6-96f1-d9805642255a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:28a483b2-14ce-5240-9fdd-95360bbc790f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:6efb38a1-293c-5f04-891f-3455f5b6c6ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:675d3586-f157-5585-9da5-fbd97b834e05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:339420f5-8125-542e-a696-a1647f7af4bb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36479 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api. Version 11.0.27 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:e09e7690-51aa-50cd-a020-c94b7e3473c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:bfce17a2-556d-5996-8aef-bd44cfb0d55c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:c44953d2-ac9e-5366-af1f-aeb0af523984", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:2bbb5b0a-35e3-5970-9d6b-e1cd995e3eae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:fd9a0fb1-7a93-5502-8818-182a8d552fc0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22201 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api. Jetty 11.0.27 is not affected by CVE-2024-22201 according to the advisories", "justification": "code_not_present" } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:bd207b81-e98a-5a98-b248-8c7e8dec25f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:e7a8488a-2e44-5c86-b1e5-ed58fa589444", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:ceed5d6f-e40d-53a3-9ee6-075d375eaf39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:5973c33e-25a0-55d8-8d81-7a3559344d22", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api. Version 11.0.27 is not vulnerable. Summary: The target repository already has the CVE-2024-8184 fix applied. The ThreadLimitHandler implementation uses atomic compute() operations with reference counting, preventing the memory leak vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:c1e11072-4f47-59ae-be49-bddb6e80154b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:1252b9d6-e991-5ecc-9b42-957f67475ed7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:cc17a493-9cd1-5553-96fa-d8728e6adf01", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:eb673f92-1566-548b-97b9-93501783d05a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:9cb51740-a83a-5f12-8e1c-348fd4b5b83c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api. not_affected \u2014 The target repository (Jetty 11.0.27.tuxcare0004) does not exhibit the vulnerability pattern described in CVE-2026-10051. The CVE describes a connection-scoped _trailers field in Jetty 12.x's HttpConnection that is never reset between requests, causing trailer data from request N to leak into request N+1 on keep-alive connections. In Jetty 11.x (the target version), trailers are managed by Http...", "justification": "code_not_present" } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:00592c52-886d-59c7-8b48-b130769d0858", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api. Version 11.0.27 is not vulnerable. Summary: CVE-2026-1605 does not apply to this Jetty 11.0.27 repository. The vulnerability specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), which has a fundamentally different architecture than Jetty 11.x. The vulnerable code patterns and files (GzipRequest, GzipDecoderSource, ContentSourceTransformer) do not exist in Jetty 11.x. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:4841a5ff-5117-5f4e-b308-ce840b61cc45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:424ff0f1-bf10-58ec-a1e9-d9572a94dc4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:9cc1aba8-9616-5f26-a731-506fd4df6e7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:98a2e294-aa10-5680-9a40-51fe195760e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:5e3a3e67-e222-5a6c-809a-d678daffc9d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:594dc65b-d3c4-56ef-94b1-01db07e17781", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:7b06cf2a-4260-50e1-834d-f309c435b0d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:9b14ad82-04a0-5903-9814-c8713875c7ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6790 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api. not_affected \u2014 Jetty 11.0.27.tuxcare0004 contains an upstream-authored fix from commit 5f25f5b389d (Feb 2023) that validates Host header against :authority pseudo-header for HTTP/2 and HTTP/3 requests. The defense rejects mismatched values with 400 Bad Request before application logic executes, preventing the dual-host-identity confusion described in CVE-2026-6790.", "justification": "code_not_present" } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:095f588f-b200-5aaf-8e62-d176ba40b060", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api. not_affected \u2014 Jetty 11.0.27 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12's integrated URIUtil.canonicalPath() method that attempts to handle both semicolon parameter stripping and path normalization in a single pass. Jetty 11 uses a two-stage architecture where decodePath() strips semicolons and canonicalPath() normalizes dots as separate operations, preventing the bug from manifest...", "justification": "protected_at_runtime" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ], "bom-ref": "urn:uuid:42a57790-8754-5f2b-8c69-e38aa0d5c49a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.27.tuxcare0005 of org.eclipse.jetty.websocket:websocket-jetty-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.27.tuxcare0005" } ] }