{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4fe395de-c8cb-5a0b-b801-8e03c68fc8b0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2", "version": "2.2.17.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.2.17.Final", "type": "library", "group": "io.undertow", "version": "2.2.17.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:119172a9-9a33-565b-b48f-c591e63f0fe3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.2.17.Final) is NOT vulnerable to CVE-2014-7816. The fix for this Windows directory traversal vulnerability was authored by Stuart Douglas (upstream maintainer) and shipped in the upstream 2.2.17.Final release that TuxCare onboarded. The defensive code that blocks or normalizes backslash characters in URL paths is present in all HTTP resource handlers (ResourceH...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5c1835d6-685c-59cc-9fe3-efdd9081691e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.2.17.Final) is NOT AFFECTED by CVE-2016-7046. The vulnerability pattern (BufferOverflowException from long URLs) is not present because the fix was already included in the upstream Undertow 2.2.17.Final release. The fix adds buffer capacity checking before writing HTTP request lines and headers, switching to incremental writing when data exceeds buffer space. A...", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2c4c39d8-0501-51b6-9718-dcb517a900f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12165 is not present in target version 2.2.17.Final. The fix was authored by Stuart Douglas (upstream) on March 30, 2017 (commit 1e72647) and shipped in the upstream release 2.2.17.Final that TuxCare onboarded. The fix adds comprehensive RFC 7230 validation: (1) header names must contain only token characters, (2) method names validated, (3) request targets reject control/forbidden cha...", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cb72b117-4e72-5dda-a974-63f820199636", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is NOT present in Undertow 2.2.17.Final. The vulnerability (missing URI validation in Digest authentication allowing MITM attacks) was fixed by upstream commits facb33a5c and 11b6f0e0 (UNDERTOW-1190) which were already included in the upstream 2.2.17.Final release that TuxCare onboarded. The target code contains the complete fix: URI validation that ensures the URI in the Digest ...", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:58cd971a-d09d-5b1b-872b-8fd3d6a82580", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 is not present in Undertow 2.2.17.Final. The vulnerability was fixed in upstream commit 3436b03e (August 2017) which was included in release 2.0.1.Final and all subsequent versions including 2.2.17.Final. The fix adds three defense mechanisms: (1) token character validation for HTTP methods and headers per RFC 7230, (2) request-target character validation blocking unsafe character...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cc702526-8081-501a-a441-cfd9a89b9c59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2670 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2017-2670 is not present in the target repository. The vulnerability affects Undertow versions before 1.3.28, where a non-clean TCP close causes an infinite loop in WebSocket processing. The fix (commit 9bfe9fbbb from June 13, 2017) was already included in the upstream Undertow 2.2.17.Final release that TuxCare onboarded. The target code at AbstractFramedStreamSourceChannel.java:301 contains the fix: the while loop exit condition checks for STATE_STREAM_BROKEN, preventing the infinite loop. This is an upstream fix authored by Stuart Douglas, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0b401728-1b7b-5ab4-9160-d80b41578502", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 affects Undertow versions 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final. The target version 2.2.17.Final is well after the fixed version boundary. The upstream release contains the complete fix: character validation via ALLOWED_TARGET_CHARACTER array in HttpRequestParser (commit 1e72647818, March 2017) plus ALLOW_UNESCAPED_CHARACTERS_IN_URL opti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8c4914b9-f277-518d-9298-3ff7b34486df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 affects Undertow's URLResource.getLastModified() method which leaked file descriptors when handling JAR URLs. The target repository (Undertow 2.2.17.Final) contains the upstream fix committed by Norito Agetsuma (882d5884f) which was already included in the upstream 2.2.17.Final release before TuxCare onboarding. The fix adds special handling for JAR protocol URLs to disable connec...", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9aee492d-57c7-5d43-8d78-15644252511c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-14642 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 (UNDERTOW-1412) describes an information leak where Undertow could serve data from a random buffer when headers are not written in the first write() call. The vulnerability was caused by writing the full buffer array length instead of the actual data length. The target repository contains Undertow version 2.2.17.Final, which already includes the upstream fix (commit a83b047d5 fro...", "justification": "code_not_present" } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:85a9ef82-f164-56fc-b3cd-0974a7a60a64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-10212 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-10212 affects Undertow versions before 2.0.20, where DEBUG logging for io.undertow.request.security could expose user credentials in log files. The target version 2.2.17.Final contains upstream fixes (commits 8b63e2585 and 20cacc96c) that prevent credential logging by removing sensitive data from debug log statements and HttpServerExchange.toString(). These fixes were part of the upstream 2.2.17.Final release before TuxCare onboarded it. The vulnerable code pattern (credentials written to log files) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:73b3ef1a-7f5d-5abc-869d-9d305cd29208", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3717ef2c-6994-54b6-a981-b23d468893df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3888 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-3888 describes credential exposure through log files when HttpServerExchange objects are logged at ERROR level. The target repository (Undertow 2.2.17.Final) contains upstream fixes that address this vulnerability: (1) UNDERTOW-1515 (commit 20cacc96c) removes requestHeaders and responseHeaders from HttpServerExchange.toString(), and (2) UNDERTOW-1576 (commit 8b63e2585) removes plaintext credentials from BasicAuthenticationMechanism debug logs. Both fixes were committed by upstream contributors in 2019 and shipped with upstream version 2.2.17.Final, which TuxCare onboarded in September 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6c71e784-fe25-5699-ad4d-7679c71e6dd1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10687 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 is not present in Undertow 2.2.17.Final. All three upstream fix commits (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) that address HTTP request smuggling via invalid characters are present in the upstream 2.2.17.Final release that TuxCare onboarded. The fixes add strict character validation for HTTP/1.x request components (paths, query strings, path parameters) and HTTP/2 pseudo-...", "justification": "code_not_present" } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2e302a4e-271b-5154-96bf-0ded9d5ffe7b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10705 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-10705 (UNDERTOW-1657) fix was already present in upstream Undertow 2.2.17.Final when TuxCare onboarded it. All three fix commits (64bbaeb7c, aa5e1fe11, b53d4589c) that address the buffer leak vulnerability in Expect: 100-continue handling are ancestors of the onboarding commit 3b4ab692b, confirming they shipped in the upstream release. The vulnerable code pattern (unreleased pooled byte buffers during 100-continue processing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:74c7432d-1140-5acf-9ac5-a67eefe99627", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10719 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 (HTTP request smuggling via chunk size integer overflow) is NOT present in this target. The vulnerability affected Undertow versions before 2.1.1.Final. This target is version 2.2.17.Final, which already contains the upstream fix (commit bfc8fbd67) that prevents integer overflow during chunk size parsing. The fix was authored by Red Hat (bspyrkos@redhat.com) and shipped in the up...", "justification": "code_not_present" } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c6b2844a-620c-5f70-9cd8-a0975ac88cf1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1745 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-1745 affects Undertow 2.0.29.Final and earlier. The target version 2.2.17.Final already contains the upstream fix (UNDERTOW-1667) that was introduced in version 2.0.30.Final. The vulnerable pattern\u2014accepting arbitrary AJP request attributes without validation\u2014has been replaced with a whitelist-based defense that only accepts known attributes or those matching an optional regex pattern. The fix was shipped in the upstream release, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).", "justification": "code_not_present" } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:28f3f8b6-4e3e-5937-b2df-94ef5af88b1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3969daad-b1a4-5269-b1da-5aab997fdfc6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27782 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-27782 is not present in Undertow 2.2.17.Final. The vulnerability involved the AJP connector failing to catch IllegalArgumentException when parsing query strings with non-RFC compliant characters, leading to connection disruption and DoS. The fix (catching IllegalArgumentException alongside ParameterLimitException in AjpRequestParser.java) was shipped in the upstream 2.2.17.Final release via commit a51659679 authored by Tomas Hofman (RedHat), prior to TuxCare's onboarding of this version. The vulnerable code pattern is not present at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0b3d3d22-0d4a-5a92-8657-b91a839487cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-20220 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-20220 is not present in this target. The vulnerability concerns HTTP request smuggling via invalid characters in HTTP/2 pseudo-headers (PATH, SCHEME, AUTHORITY). The fix (UNDERTOW-1780) validates each byte of these headers against character whitelists, rejecting requests with invalid characters. This fix was applied by upstream (Red Hat) in commit a18574a4d and shipped in Undertow 2.2....", "justification": "code_not_present" } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:69844840-f1da-554e-84de-df6c83f0fff3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3597 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 is NOT present in the target. The vulnerability was fixed in upstream Undertow via commit b92904715 (UNDERTOW-1842), which was already included in the upstream release 2.2.17.Final that TuxCare onboarded. The fix ensures that when AbstractFramedStreamSinkChannel.flushComplete() encounters a final frame with remaining body data, it requeues the final frame via queueFinalFrame() ins...", "justification": "code_not_present" } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:df06c67e-63bf-5a2c-8c5f-baf5500c42d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3629 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3629 is not present in Undertow 2.2.17.Final. The fix for the HTTP/2 flow control DoS vulnerability was included in the upstream release. The vulnerable pattern (indefinite blocking in awaitWritable() when peer doesn't send WINDOW_UPDATE frames) has been replaced with timeout-protected wait operations and flow control window validation.", "justification": "code_not_present" } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8da60add-2d1e-5f54-a0c1-576e9cb854b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3690 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2021-3690 (WebSocket PONG buffer leak) is NOT present in Undertow 2.2.17.Final. The fix was shipped in upstream release 2.2.10.Final (CVE states vulnerability exists \"before 2.0.40 and 2.2.10\"). The target version 2.2.17.Final already contains the fix (commit c7e84a0b7) which adds proper buffer cleanup via bufferedBinaryMessage.getData().free() in the else-path when no PONG message handler is registered. The fix is present at FrameHandler.java lines 155-157.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:61260247-0485-53cb-9062-de634b7449fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3859 does not affect version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.2.17.Final) is not affected by CVE-2021-3859. The vulnerability involved HTTP/2 continuation frames not being consumed immediately from the buffer, causing timeout-based denial of service. The fix was already present in the upstream 2.2.17.Final release that TuxCare onboarded in September 2026. Both Http2Channel.java and HpackEncoder.java contain the complete fix authored by Red Hat engineers (rmartinc@redhat.com) in September 2021. The vulnerable code pattern (unbuffered continuation frame processing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).", "justification": "code_not_present" } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7ac9ce66-c838-5146-8a65-c17bf77c214f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6e30e2a6-871e-500f-87ef-d27b8950de35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1319 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d08a98fe-bf80-51dc-9fd4-6bcd08dc2706", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-2764", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:49424db0-14cb-5f22-a4a5-3881f985dfa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2764 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0834292f-79e9-5088-910c-411f1ceba6c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core, and is fixed in 2.2.17.Final-tuxcare.3." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:03f9c1c0-84d3-5ed9-81d4-8f9f54b5880b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e5139321-120f-5f3b-8d33-434b6dd7a186", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:46341514-d8f9-56fa-965a-c01908fc0069", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:462a22c7-6858-5e91-90a6-283e0f50f35b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c5a96e6b-fb2a-540f-912f-35caa4cbd659", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a5ca48b1-4d43-5d4e-8dd8-1b788d368459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:877a8bd6-f99d-5eb2-abae-8bd1dc16e76b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:af3eedfa-ebda-5f62-8949-a1d0eb1bdfab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9282d3a3-cb70-5514-ba92-f4a3e16bddc8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.2.17.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7fd58382-b68a-59cb-97d3-ff22ff6ad649", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:eeaee0ed-99b0-55f7-90d6-4d4fab5af48a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6162 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:deec1fc7-d202-550e-8bc3-c62b12232c5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e6fef2d3-4073-5abe-8c76-41db9b4b4adb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:83e0d289-f901-590e-a965-6bee0b2854be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bb2c5413-ad6f-5899-a9ee-b49554f744e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ae5943f6-4977-5b02-9727-c74947442ed8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:062f3a81-6668-5b15-90cc-ee9ab65bbcce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:462e1b91-82d5-5a06-8743-74fcb05f2866", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.2.17.Final-tuxcare.2 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.17.Final-tuxcare.2" } ] }