{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:22f6c9d3-0e5c-57d5-819f-6a16022475f5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2", "version": "2.2.20.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.2.20.Final", "type": "library", "group": "io.undertow", "version": "2.2.20.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d3c43625-edd7-5cec-a081-4b41e80c0e9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 is a directory traversal vulnerability in Undertow versions 1.0.x-1.2.x when running on Windows, allowing attackers to read arbitrary files using backslash characters in URLs. The target version 2.2.20.Final is NOT affected because the upstream fix (UNDERTOW-338) was committed by Stuart Douglas on 2014-10-28 and was already present in the 2.2.20.Final release that TuxCare onboarde...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cb3eef13-51e8-5d9c-9054-e4530c06692e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 (BufferOverflowException on long URL proxy requests) is NOT present in Undertow 2.2.20.Final. The vulnerability was fixed in upstream commit c518b5a17 (UNDERTOW-835, Sep 2016) by Stuart Douglas, which added length pre-checks and incremental buffer writing to HttpRequestConduit.java and overflow handling to HpackEncoder.java. This fix was already included in the upstream 2.2.20.Fin...", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2c79fe13-3794-5498-adbc-77aad0a2c61c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.2.20.Final) is NOT AFFECTED by CVE-2017-12165. The complete fix for this HTTP request smuggling vulnerability was already present in the upstream Undertow 2.2.20.Final release when TuxCare onboarded it. The fix, authored by Stuart Douglas in commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f (JBEAP-9909), implements RFC 7230-compliant validation of HTTP headers, m...", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:93826086-61ed-564d-8c6a-d8c778b58915", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 (UNDERTOW-1190) concerns missing URI validation in Digest authentication that allows MITM attacks. The target repository at version 2.2.20.Final already contains the complete fix, which was shipped in the upstream release before TuxCare onboarded this version. The fix validates that the digest-uri in the Authorization header exactly matches the HTTP request URI (supporting both r...", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bc2f319b-da27-50c7-973a-634c90d4a816", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 (HTTP request smuggling via invalid characters in request lines) is NOT present in target Undertow 2.2.20.Final. All three vendor patches (JBEAP-9909 token/header validation + UNDERTOW-1165 strict whitespace) were already applied in the upstream 2.2.20.Final release before TuxCare onboarded it. The fixes were authored by Stuart Douglas (upstream maintainer, NOT TuxCare). Target co...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ae5ea56e-8f0e-5170-9e1a-d6f283c26a5f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2670 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2017-2670 affects Undertow before version 1.3.28, where a non-clean TCP close on WebSocket connections causes an infinite loop in IO threads. The target repository (Undertow 2.2.20.Final) contains the upstream fix from June 2017 (commit 9bfe9fbbb). The fix adds STATE_STREAM_BROKEN to the loop exit condition in AbstractFramedStreamSourceChannel.java line 301, preventing infinite iteration when connections terminate abnormally. This fix was part of the upstream 2.2.20.Final release (Oct 2022) before TuxCare onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:af3aa048-faf8-5eb4-9eae-8680a4dc5ffd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 describes an incomplete fix for CVE-2017-2666 where invalid characters were still allowed in query strings and path parameters, enabling HTTP response manipulation. The target (Undertow 2.2.20.Final) contains comprehensive character validation in HttpRequestParser that blocks control characters and dangerous special characters in all three request parsing methods (handlePath, hand...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:50e2625c-8eb0-5762-8369-c17405efdec9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 affects Undertow's URLResource.getLastModified() method, which caused file descriptor leaks when accessing JAR resources. The vulnerability occurred because calling JarURLConnection.getLastModified() opened file descriptors that were only closed during finalization, leading to resource exhaustion.", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1804ba00-3d49-5fab-9aa0-a068c055c44f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-14642 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 (UNDERTOW-1412) is NOT present in target version 2.2.20.Final. The vulnerability involved an information leak where HttpResponseConduit.processWrite would write entire buffer arrays (data.length) instead of just the valid data portion (length+1), potentially exposing uninitialized or stale buffer contents from previous requests. The fix was already included in the upstream 2.2.20...", "justification": "code_not_present" } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a197ad26-c503-5562-9b09-a4c1a7173972", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-10212 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. Target version 2.2.20.Final is not affected by CVE-2019-10212. The vulnerability concerned credentials being exposed in DEBUG logs through two vectors: (1) BasicAuthenticationMechanism logging plaintext username:password in debug statements, and (2) HttpServerExchange.toString() including headers with Authorization data. Both fixes were applied by upstream Undertow developers and shipped in the 2.2.20.Final release that TuxCare onboarded. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2de0153a-8247-58e2-9469-4048260159f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-14888 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. Version 2.2.20.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vjxc-frw4-jmh5 (affected below 2.0.29.Final), NVD (affected up to 2.0.28), CVE record (affected below 2.0.28.SP1), Snyk (affected below 2.0.29.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2891bb24-7bb8-5d09-a387-c73da8e0ae62", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3888 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-3888 is NOT present in Undertow 2.2.20.Final. The vulnerability involved logging HttpServerExchange objects at ERROR level, which would expose HTTP headers (including Authorization headers with plaintext credentials) through the toString() method. The upstream vendor fixed this in UNDERTOW-1515 (commit 20cacc96c, March 2019) by removing request and response headers from HttpServerExchange.toString(). This fix shipped with the upstream 2.2.20.Final release and predates all TuxCare work on this branch. The current code at line 2533 of HttpServerExchange.java returns only the HTTP method and URI, preventing credential exposure.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:92b3b307-072d-5461-a32d-848233632ec6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10687 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 affects Undertow versions before 2.2.0.Final due to HTTP request smuggling caused by permitting invalid characters in HTTP requests. The target repository is Undertow 2.2.20.Final, which already contains the upstream vendor fix. The fix commits (a18574a4d for HTTP/2, 3436b03ed for HTTP/1.x) were authored by Red Hat engineers and shipped in the upstream 2.2.20.Final release before...", "justification": "code_not_present" } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:571f1e3e-43a9-5684-934e-b875625ed4da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10705 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-10705 (UNDERTOW-1657) affects Undertow versions before 2.1.1.Final. The target repository version 2.2.20.Final contains all three upstream fix commits (64bbaeb7c, aa5e1fe11, b53d4589c) that address the buffer leak vulnerability in Expect: 100-continue handling. These fixes were authored by Red Hat engineers and shipped in upstream release 2.1.1.Final, which predates the 2.2.20.Final version onboarded by TuxCare. All defense mechanisms are present and active in the target code: ResponseCommitListener preventing buffer leaks, terminateRequest calls on EXPECTATION_FAILED, freeContinueResponse() buffer cleanup, extraBytes cleanup on non-persistent connections, and terminateRequestChannel implementation. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1ddc3cb8-6163-5366-92b2-e28740f290ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10719 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 is NOT present in Undertow 2.2.20.Final. The vulnerability (unbounded HTTP chunk size accumulation leading to integer overflow and request smuggling) was fixed in upstream commit bfc8fbd67 by Red Hat on Feb 25, 2020, and shipped in upstream release 2.1.1.Final. The target version 2.2.20.Final (> 2.1.1.Final) inherited this fix when TuxCare onboarded the upstream release in commit...", "justification": "code_not_present" } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:fb6dc63d-2fb4-597b-a8fe-8263b54bed84", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1745 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-1745 (AJP connector file inclusion vulnerability) is not present in target version 2.2.20.Final. The upstream fix (commits e60e04f4e and b976853c8) was already included in the upstream 2.2.20.Final release before TuxCare onboarded this version. The fix implements attribute name filtering in AjpRequestParser: unknown AJP request attributes are now rejected by default unless they match an explicitly configured allow-pattern (AJP_ALLOWED_REQUEST_ATTRIBUTES_PATTERN). The secure-by-default behavior is active without additional configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).", "justification": "code_not_present" } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:41b30551-bcd5-5e11-8db5-578c3817f45f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3ce2bd1b-7d70-5acb-a98b-e0bb880f8ed4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27782 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-27782 is NOT affecting this version. The vulnerability concerns the Undertow AJP connector's handling of query strings with non-RFC compliant characters (e.g., malformed percent-encoding like \"param=value%http\"). The upstream vendor (Red Hat/JBoss) fixed this issue via UNDERTOW-1404 and UNDERTOW-1824, and these fixes were already included in the upstream 2.2.20.Final release that TuxCare onboarded. The fixes prevent IllegalArgumentException from propagating during query string parsing and ensure proper AJP error responses are sent instead of abrupt connection closures.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:be42f1bf-042d-5b37-b382-fe367183efb9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-20220 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-20220 addresses HTTP request smuggling via invalid characters in HTTP/1.x and HTTP/2 requests. The target repository (Undertow 2.2.20.Final) contains both required fixes: (1) HTTP/2 pseudo-header validation for :path, :scheme, :authority, and :method headers, and (2) HTTP/1.x header field-name whitespace rejection. Both fixes were committed by upstream Red Hat developers (bspyrkos@redh...", "justification": "code_not_present" } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7389519e-51f0-523d-b2b2-b7b1a8dc8f62", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3597 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 (UNDERTOW-1842) is NOT present in Undertow 2.2.20.Final. The vulnerability - where HTTP/2 final frames are lost when body bytes remain during flush completion, causing denial of service - was fixed by upstream commit b92904715 authored by frainone@redhat.com. This fix was already included in the upstream 2.2.20.Final release before TuxCare onboarded it (first TuxCare commit: 4baf9...", "justification": "code_not_present" } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d207b577-0b37-5afc-93cf-f49bb8f79f9c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3629 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3629 affects Undertow versions prior to 2.0.40.Final and 2.2.11.Final, addressing an HTTP/2 flow control DoS vulnerability where server threads could block indefinitely waiting for WINDOW_UPDATE frames. The target version 2.2.20.Final already contains the upstream fix (UNDERTOW-1910) that was shipped in the upstream 2.2.20.Final release before TuxCare's onboarding. The vulnerable code ...", "justification": "code_not_present" } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:48b4b987-2bfa-5b46-b80a-a9ce131ab047", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3690 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2021-3690 is not present in the target Undertow 2.2.20.Final repository. The vulnerability involved a buffer leak in the WebSocket PONG message handler when no PONG handler was registered. The fix, which adds proper buffer cleanup in the else branch of onFullPongMessage(), was already included in the upstream Undertow 2.2.20.Final release before TuxCare onboarded it. The vulnerable code pattern (missing buffer.free() call) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4db20236-f0cb-5a62-b8f6-47297cf035a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3859 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (io.undertow version 2.2.20.Final) is not affected by CVE-2021-3859. The vulnerability relates to incorrect handling of HTTP/2 CONTINUATION frames that could cause server timeouts and denial of service. The fix commit e43f0ada3 (authored by Red Hat) was already present in the upstream release 2.2.20.Final that TuxCare onboarded. Both required code changes are verified present: (1) Http2Channel.parseFrame() includes the do-while loop to process continuation frames from the buffer, and (2) HpackEncoder.encode() correctly advances the header iterator outside the overflow block.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).", "justification": "code_not_present" } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:23b3eadc-c4e8-59ff-9429-48ea9258fc1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9f60cff4-f239-5f51-9919-d46874bae301", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-2053 does not affect version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2022-2053 is NOT present in the target (Undertow 2.2.20.Final at SHA 4b82135f4). The vulnerability involved AjpServerRequestConduit silently closing connections when POST requests exceeded max-post-size, causing proxies to mark backends as error state (DoS). The fix (commit 7d3a045da) adds a specific catch block for RequestTooBigException that re-throws it for proper upstream error handling, preventing silent connection closure. This fix was shipped in the upstream 2.2.20.Final release (before TuxCare onboarded it at commit 4baf9028f). The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2).", "justification": "code_not_present" } }, { "id": "CVE-2022-2764", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b667d74c-27ae-5ad8-8d14-6f80ebb844d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2764 affects version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ef013eb1-edc3-5699-9e66-bda8cc5b1a71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core, and is fixed in 2.2.20.Final-tuxcare.3." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:26b5b461-6c26-5464-9e54-12704087a6bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-1108 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a9abf90d-c1c1-5967-a66a-1e799f4b80c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:93be2e25-9a98-5e61-990a-92cf4aef1a38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:694366cb-0b56-5d56-b41f-3532e6029aad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ed3ced32-4bc9-5658-8553-0262ea949ab8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:11332878-5ca4-56e2-94a4-edbb52c4f011", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7891db23-88fe-5967-9880-927daf70d101", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:462594ac-ec48-57af-9fed-c3698c67408c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bdd214c1-ee74-52d5-98f9-485852e5c151", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.2.20.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ae6d2405-6d9d-5a06-9272-5bb5ba6bcce7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:53af47b2-388c-5786-8af6-3557ffd1d414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6162 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3d15c157-0e21-5984-8234-52cdb0fbcbb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3ccf46a9-83ce-5e51-afcd-64be4f4c314e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:eeeacc38-fb6f-533d-bac4-b7fd6f746dc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:52bb6cbf-b81a-5e08-bda4-21b478d45e92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:41e07847-706c-59cc-a07b-485ee8386258", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:091c28a5-cb8f-5cef-be53-3dbcb5ebf917", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a0406c8c-e7f2-541d-a4d6-afdf8c8b17e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.2.20.Final-tuxcare.2 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.20.Final-tuxcare.2" } ] }