{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e84bd04f-4151-5240-8496-6c6df0b43734", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "websocket-server", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7", "type": "library", "group": "org.eclipse.jetty.websocket", "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7", "version": "9.4.58.v20250814-tuxcare.7", "pedigree": { "ancestors": [ { "name": "websocket-server", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814", "type": "library", "group": "org.eclipse.jetty.websocket", "version": "9.4.58.v20250814" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:317c9266-10d3-57ba-a8b7-bb8c185d67ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:6e4add48-3f63-5136-af13-a5ce40f4eef3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:382413b8-2f3d-51f7-b9ca-3250e3ee64cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:8dd2d13a-6f9e-5ab8-a4cf-09579acc2095", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:a6abfb10-9ada-5a09-9830-e19fa04003e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:bc2edf3a-930d-578d-b943-2ec6220a7a7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:9f8ef235-a3f2-52bf-9ba7-7a7f6ced70e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:050e1d1f-fea0-5364-a06b-fcb036559b8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:a1cf15de-2cf5-5963-a2bf-9c6f10297ef2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:c83ec24f-e633-5955-b63b-2bda67727bc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:a4ebcaeb-ebc3-59fe-ab38-ba39f9fecf8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:206e3dbd-de6c-5048-ac63-aefc93456132", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:42add3ee-782c-5740-87a9-2b0c2da55446", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:535b9488-b3bc-5477-ab72-3f718f5809b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:c601cdaf-8303-5a2e-8a69-fea21ac0e375", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:d20e0413-600a-522a-b7dc-fb43753baa0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:8d98f648-4060-52e0-84b3-98de3ad15437", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:6878e4ed-e0c5-5823-ac4b-04c51068d30a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:5bea9e27-a38e-5bb2-914c-0cd357052600", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:733fd37c-35e9-5b34-bd64-9c47e0c9c92b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:c9e88c21-6074-5213-9244-38f67a2d996e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:1f737b1e-1d41-5bab-9219-8c059edfb098", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:b431fda6-ea45-52dc-9e28-cbc0530a4e50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:a73e0640-0c2d-579d-bcba-418f2dfd9176", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:5e8237b4-a0b0-5559-a928-dc131a00186f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:8240700d-7121-5751-864c-d9cd27b6bc44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:1dcfccb0-1b3f-534c-a23a-1ae95e8b67a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:21933709-ae24-5870-a86d-4235937219ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:521a4cb1-6626-5ba2-9e06-70cc9dfdf817", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:918b388b-e1bd-5921-9c04-f5de9cbebee0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:469e4436-18c5-584d-9f24-9a143f437d13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:1a70c22e-ccc7-5dd3-b5d7-7bebe9dbbe77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:57256bae-e7c3-5b1d-9742-225dd6aac199", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:b6c962ce-94d7-54a6-a099-b4fee6c22892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:c1d1638c-32cd-5c70-a64a-356da34f2be9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:e76372c7-8782-566c-8a82-0f091fb7dc06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:f5ef0d1b-7b9c-5742-ae3d-f7cfa250bfbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:4f5d694e-c953-5dd0-945e-9c2ae66bf2f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:0c6d2857-c9fb-5066-ad23-6bc249977be1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.websocket:websocket-server. not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.58.v20250814-tuxcare.7" } ] }