{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e19e299f-69a7-5972-83e2-ea71cc63d76a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "websocket-jetty-api", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004", "version": "11.0.29.tuxcare0004", "pedigree": { "ancestors": [ { "name": "websocket-jetty-api", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29", "type": "library", "group": "org.eclipse.jetty.websocket", "version": "11.0.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:685a6b2c-a039-580e-867b-c27df66f62b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:8fef03ed-8932-588b-89db-fc36b945134a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:aa403a02-b1bb-58dc-8d35-0f6033e9ad2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:33114851-60cd-52b2-b387-ec014a3b48b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:d456285c-357b-571a-99b8-fb1e65cb8216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:82369aa6-c6c3-5ba1-83f0-e3e5200ae099", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:6f33812a-57ac-593a-ab9b-d5330f57b839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:8e012c06-131b-5f14-923e-003ca54b1b04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:4117540f-fcd4-5797-9a2e-ff4d452d44c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:110866e6-1595-58e5-9946-9f41c39ff898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:f4c963da-3c80-5dfd-9bf3-5a397553c5a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:c3e694e4-cfb7-551f-b018-bede5fead5ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:124e5692-e2b6-53a9-9409-a07ec19b60d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:c034814d-7e1b-5bac-893a-62863efe9a6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:eed7eb1d-06db-518c-a6a0-22abb4527d7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:3a04b1be-09e6-5bdb-824b-53fa5a55a0be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:636c418e-1c8b-5d35-a61f-1e1a9a551f8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:a35a5ee4-c7ab-5d0a-a944-eaec365b0826", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:551dccb8-56af-5186-9654-442b20f6be43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:bf7f862b-620a-5606-824a-dfae4500947a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-28164", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:1151eb1a-88aa-5150-81d4-ed1edc065080", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28164 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:3b22e54a-5318-5620-a134-944cefcfac5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:91919430-d35e-57d7-abda-3fb38ecbee6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28169 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:a4ff4e15-c8fb-5562-8842-8ea3fb0a686e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2021-34429", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:706866b4-07ad-5e2b-94ce-3e620dba9843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:c9b49900-5861-5188-af64-0fe9684ded77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2022-2048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:9e3dac28-c8a8-5a22-ab81-626a18498773", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:eddfe4a0-349b-5a55-a95a-43d525b92132", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:a549ec79-c6ba-5c44-95bb-dfa965c13e1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:ab4d8b98-0755-593c-9841-5ec00c368c8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:43a8189a-4526-59b6-8ed1-91b233969890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:99b2bb07-fe49-511a-896a-22a09f97b128", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36479 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api. Version 11.0.29 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:69d3e2af-55f2-5db3-b465-10f089415e4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:4f1770f4-7e51-59e2-a503-d9508b1a916d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:bd490878-bcf0-55c8-806d-de4b56dc51de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:e72f8087-7b9f-5375-8ea1-81dbd7dce7f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:773c59e8-ba09-52c5-9b9b-20a9fe313a31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2024-6762", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:4228b147-730c-537b-93bf-721a25f8b91f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:0374a870-604a-5b31-9e1a-300b0a34f480", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:fcd4e296-9cbf-5e30-9de3-af5939101dec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:bd8a380d-0a23-5432-9df2-de0025edcfa3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:bd676628-d14b-5038-9b7e-a35f35620d55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:49b2eee9-37cf-505d-8f7c-a873e71dc230", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:cc7ac98b-1a6f-5831-84d6-fe9948f75b0d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5115 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "code_not_present" } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:47205711-2011-5efe-b0d9-f7da02c09b6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:f8c15130-edb8-5f7c-ac70-eb2f04e25ccf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:58fd539b-835d-5cfe-b810-e7c9632dcb57", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:6f19057c-bb2e-5bc5-b04f-c17a7d51ff66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:e100a753-5e64-5579-b912-cd70e0f6d1e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:a81b57ca-df84-569a-83fb-330b956ec95e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:5095c49e-8cc6-549c-9656-f33ea5993dcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:28c3d320-d6c3-5b0e-a8e1-84cc573d3fd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:c7c39691-b407-5c4e-8efa-94c9d2f66251", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:0ecb18d5-535b-5db8-affd-1f003a8780aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:2fdbe4b8-c2a5-519e-a429-8d70460f97ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:c1662223-f54e-5961-a8db-bf69306e3b6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api. not_affected \u2014 Jetty 11.0.29 uses a fundamentally different architecture from the vulnerable Jetty 12.x code. The CVE describes a bug in Jetty 12's single-pass canonicalPath() method that performs both parameter stripping and path normalization inline. Jetty 11 uses a two-pass architecture where decodePath() strips semicolon parameters first, then canonicalPath() normalizes the result separately. This archite...", "justification": "code_not_present" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ], "bom-ref": "urn:uuid:db6b5f3d-a0c8-5227-903a-94ed7d3a4457", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 11.0.29.tuxcare0004 of org.eclipse.jetty.websocket:websocket-jetty-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-jetty-api@11.0.29.tuxcare0004" } ] }