{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4c062e05-6dd4-57a0-92fb-e9a70ea46d25",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-core",
      "purl": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2",
      "version": "2.2.37.Final-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-core",
            "purl": "pkg:maven/io.undertow/undertow-core@2.2.37.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.2.37.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-7816",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:12bb9dba-ddbe-5655-a49c-74df121145ef",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-7816 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 (directory traversal via Windows backslash characters) is NOT present in Undertow 2.2.37.Final. The upstream vendor fix (UNDERTOW-338, commit 28f244e63) was already included in the 2.2.37.Final release that TuxCare onboarded. The fix prevents path separator confusion attacks on Windows by detecting and either normalizing or rejecting URIs containing backslash characters in PathSep...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-7046",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bf4d0f84-6515-507f-be12-738ff1e22000",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-7046 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 (UNDERTOW-835) is NOT present in Undertow 2.2.37.Final. The vulnerability involved BufferOverflowException when processing HTTP requests with URLs exceeding available buffer space. The upstream fix from September 2016 (commit c518b5a1) is present in this version, which shipped long after the fix. All three defensive code changes are confirmed: (1) HttpRequestConduit checks buffer ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12165",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:41fe4692-df9f-5003-b6da-1e85b9149482",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12165 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12165 is not present in Undertow 2.2.37.Final. The vulnerability affects versions before 1.4.17, 1.3.31, and 2.0.0. The fix was shipped in the upstream release by commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f (authored by stuart.w.douglas@gmail.com), which is an ancestor of HEAD and predates all TuxCare maintenance on this version branch. The target contains all the defensive validat...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12196",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2d37e324-3fc9-5f2a-a237-e587fd0399a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12196 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 describes a vulnerability in Undertow's Digest authentication where the server does not validate that the URI in the Authorization header matches the URI in the HTTP request line, allowing MITM attacks. The target version 2.2.37.Final at SHA c85edf915 is NOT AFFECTED because the upstream fix was already present in the release when TuxCare onboarded it. The fix (commits facb33a5c ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-2666",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5e689068-2496-5a59-8658-c3732e3f9cd6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-2666 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.2.37.Final is NOT affected by CVE-2017-2666. The vulnerability involves HTTP request smuggling through invalid characters in request lines that could enable response injection, cache poisoning, XSS, or information disclosure. The vendor fix (commits JBEAP-9909 and UNDERTOW-1165) adds three defense layers: (1) RFC 7230 token character validation for HTTP methods and header ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-2670",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:beeb3cb9-b497-58a8-bdfc-0f8c418cf675",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-2670 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2017-2670 affects Undertow versions before 1.3.28 where a non-clean TCP close on WebSocket connections causes IO threads to enter an infinite loop, resulting in DoS. The target repository (Undertow 2.2.37.Final) is NOT vulnerable because the fix was already present in the upstream release that TuxCare onboarded. The fix, authored by upstream developer Stuart Douglas (commit 9bfe9fbbb), adds a STATE_STREAM_BROKEN check to the read loop condition, ensuring the loop exits when the stream is broken. This fix was shipped in upstream releases starting from 2.0.0.Beta1 and was already in place before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7559",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7cbfd9ff-25cd-54bc-9a01-cbd93e4010a3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7559 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 affects Undertow 2.x before 2.0.0.Alpha2. The target is Undertow 2.2.37.Final, which already contains the upstream fix for invalid character validation in query strings and path parameters. The character validation code was introduced by upstream commit 3436b03eda8b (UNDERTOW-1165) authored by stuart.w.douglas@gmail.com on 2018-03-02. This fix was already present in the upstream r...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1114",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f962daad-037c-5a3f-b433-e9240788eea6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1114 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target is not affected by CVE-2018-1114. The vulnerability (file descriptor leak in URLResource.getLastModified() when handling JAR URLs) was fixed by the upstream Undertow project in commit 882d5884f, which was already present in the 2.2.37.Final release before TuxCare onboarding. The fix code is present in URLResource.java lines 92-98, where jar protocol URLs now use File.lastModified() i...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-14642",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:07a2a936-d981-5e73-b09d-899a41730583",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-14642 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 is not present in target version 2.2.37.Final. The vulnerability was an information leak in HttpResponseConduit.java where stale buffer data from previous HTTP requests could be transmitted to clients due to writing data.length instead of length+1 bytes. The fix (UNDERTOW-1412) by Stuart Douglas was applied on Sep 13, 2018, changing line 146 from 'res = next.write(data, 0, data.l...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-10212",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ae977dc0-e932-542f-832a-9a77270c8d1f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10212 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-10212 is not present in this target. The vulnerability involved DEBUG logging of HTTP Basic Authentication credentials in plaintext. The upstream fixes (commits 8b63e258 for UNDERTOW-1576 and 20cacc96c for UNDERTOW-1515) were already included in the upstream release that TuxCare onboarded. The target code does not log plainChallenge or base64Challenge values, and HttpServerExchange.toString() does not include request/response headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-14888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0246c012-89bb-5351-9f9d-c739baba9925",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14888 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. Version 2.2.37.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vjxc-frw4-jmh5 (affected below 2.0.29.Final), NVD (affected up to 2.0.28), CVE record (affected below 2.0.28.SP1), Snyk (affected below 2.0.29.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-3888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ab925088-8910-50de-a295-04387e82f5dd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3888 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-3888 is NOT present in Undertow 2.2.37.Final. The vulnerability involved logging plain text credentials through HttpServerExchange.toString() which included request/response headers. The upstream fix (commit 20cacc96c, UNDERTOW-1515) removed headers from toString() on March 28, 2019, shipping in upstream releases before TuxCare onboarding. The target contains this fix and does not expose credentials in logs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10687",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3878adc5-1bd9-5c82-8fc1-d18cdcb9c740",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10687 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 concerns HTTP request smuggling via invalid characters in HTTP requests (tabs, newlines, forbidden bytes in request-line components). The target Undertow 2.2.37.Final already contains all relevant security fixes: (1) HTTP/1.x character validation in query/path parameters (UNDERTOW-1165, commit 3436b03ed from 2017-08-04), (2) HTTP/2 pseudo-header validation for :path/:scheme/:auth...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10705",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a1712836-0077-51d6-ad82-5211f17d8d9f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10705 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-10705 affects Undertow versions before 2.1.1.Final. The target is Undertow 2.2.37.Final, which already contains the complete UNDERTOW-1657 fix in its upstream release. The vulnerability involved buffer leaks when handling Expect: 100-continue requests. The fix (commit aa5e1fe11fec75032f14f0ae23e586f4cf3a3365) was authored by Stuart Douglas and shipped in upstream Undertow 2.1.1.Final, well before the 2.2.37.Final release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10719",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:155414f4-8e97-591d-b994-b476feec086b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10719 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.2.37.Final) is not affected by CVE-2020-10719. The upstream vendor (Red Hat) fixed the integer overflow vulnerability in commit bfc8fbd67f6b3dd96702b363f61cf805baf3c6cf, which shipped in the upstream release 2.2.37.Final that TuxCare onboarded. The fix validates chunk size before left-shift operations to prevent overflow during chunked transfer encoding parsing...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1745",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:11367d8a-ba30-5d41-9bff-bfa229b1a977",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1745 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-1745 affects Undertow 2.0.29.Final and earlier due to accepting arbitrary AJP request attributes, enabling file disclosure and potential RCE. The target version 2.2.37.Final contains the upstream fix (commit e60e04f4e, UNDERTOW-1667) authored by Red Hat in February 2020. The fix rejects unknown AJP attributes by default, only accepting known attributes or those matching an explicit allowlist pattern. This fix was already present in the upstream release before TuxCare onboarding. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1757",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:505b34bb-5b7b-564d-835e-958603acaced",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1757 affects version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-27782",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cdbc8fa9-2320-5da0-afd8-e19ea22ce9fd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-27782 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. Target version 2.2.37.Final is not affected by CVE-2020-27782. The vulnerability affected Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1, but was fixed in upstream releases 2.0.14.Final (UNDERTOW-1404) and 2.2.4.Final (UNDERTOW-1824). Both fixes were already present in the upstream release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-20220",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d2d54f8d-5ce2-5ab1-8868-735b13df95b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-20220 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.2.37.Final) is not vulnerable to CVE-2021-20220. The vulnerability fixes were already present in the upstream release that TuxCare onboarded. The upstream fix commit a18574a4da09449d855c0a7e58dfca3e9e2e488e (authored by bspyrkos@redhat.com) added character validation for HTTP/2 pseudo-headers and was included in the base 2.2.37.Final release before TuxCare's ma...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3597",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:73d56b2d-ffd0-5cc4-9136-46a06ef21abe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3597 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 is not present in Undertow 2.2.37.Final. The vulnerability (UNDERTOW-1842) involved AbstractFramedStreamSinkChannel.flushComplete() failing to requeue the final frame when remaining header data existed, causing HTTP/2 connections to hang. The upstream fix by Flavia Rainone (commit b92904715) was already included in the 2.2.37.Final release that TuxCare onboarded, prior to any TuxC...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3629",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:98ec3749-a713-56d3-a7f9-a9ed4c81bf54",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3629 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3629 is not present in Undertow 2.2.37.Final because the upstream vendor fix (UNDERTOW-1910) was already included in this release. The vulnerability involved HTTP/2 flow control handling where a malicious peer could exhaust server resources by withholding WINDOW_UPDATE frames, causing worker threads to block indefinitely. The fix adds a configurable timeout (default 600 seconds) to the...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3690",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d99105c1-3d78-5cac-b1c9-f70627efdecc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3690 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2021-3690 (WebSocket PONG buffer leak) is NOT present in Undertow 2.2.37.Final. The upstream fix (commit c7e84a0b7) by Andrey Marinchuk was released in upstream version 2.2.10.Final. The target version 2.2.37.Final includes this upstream release, so the vulnerable pattern does not exist. The fix adds bufferedBinaryMessage.getData().free() at line 156 in FrameHandler.java to prevent memory leaks when PONG messages arrive without a registered handler.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3859",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5739877c-9b4e-56da-afe1-d7883c60ce12",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3859 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2021-3859 affects Undertow versions < 2.2.15.Final due to improper handling of HTTP/2 CONTINUATION frames. The target version 2.2.37.Final contains the upstream fix (commit e43f0ada3) that was already present in the upstream release before TuxCare onboarded it. Both patched files (Http2Channel.java and HpackEncoder.java) contain the corrected code. The vulnerable pattern where continuation frames in the same buffer were not consumed properly, causing parser stalls and timeouts, is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-2053",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c3aa6bc9-928d-5805-a96e-8927e56113b2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-2053 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2022-2053 affects Undertow's AJP protocol handling when POST requests exceed max-post-size limits, causing silent connection closure that marks backend servers as unavailable. The target repository (Undertow 2.2.37.Final at SHA c85edf915) already contains the upstream fix. The vulnerable code pattern is not present - the fix was included in the upstream release before TuxCare onboarded version 2.2.37.Final. Fix commit 7d3a045da adds a specific RequestTooBigException catch clause that re-throws the exception for proper upstream handling, preventing the silent connection closure described in the CVE. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-4492",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cc2c7881-86c7-5500-9e56-cbbfd64a5eea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-4492 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.2.37.Final) is not affected by CVE-2022-4492. The vulnerability fix was already present in the upstream release 2.2.24.Final (committed 2022-12-14 by rmartinc@redhat.com), which predates TuxCare's onboarding of this version. The fix enables HTTPS endpoint identification by default in both HttpClientProvider and Http2ClientProvider, ensuring server certificate validation during SSL/TLS connections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-1108",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f3aef3da-50b9-5f23-aa96-6b48aa7cdfb2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-1108 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2023-1108 affects Undertow's SslConduit.wrapAndFlip() method, where an infinite loop could occur during SSL/TLS handshake processing. The vulnerability was fixed in upstream commit 1302c8cf4 (Feb 2023) by adding a check for engine.isInboundDone() to the while loop condition. This fix was already present in upstream release 2.2.24.Final. The target version 2.2.37.Final includes this upstream fix (the fix commit is 247 commits before TuxCare's first commit de6bae485). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-1973",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:026749cf-7840-59dc-9a01-bcc20863777a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-1973 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2023-1973 is not present in Undertow 2.2.37.Final. The fix was already included in the upstream 2.2.37.Final release before TuxCare onboarding. The vulnerability allowed DoS via OutOfMemory by creating many sessions with long/unlimited timeouts during form authentication. The upstream fix (commit b289b18) limits session timeout to 120 seconds during authentication, then restores the original timeout after authentication completes. This defense is fully present and active in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final), Snyk (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-4639",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c09d925c-fbb8-5208-a7ba-b227a7df38df",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-4639 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2023-4639 (cookie parsing vulnerability) is NOT present in Undertow 2.2.37.Final. The fix was already included in the upstream release before TuxCare onboarded it. The vulnerable pattern (improper handling of unterminated quoted cookie values) was removed by upstream commit ea7ea2525 authored by baranowb@gmail.com and committed by frainone@redhat.com (Red Hat). The fix correctly handles cookies with quoted values that lack closing quotes before delimiters, preventing cookie boundary confusion that could lead to HttpOnly cookie exfiltration or cookie spoofing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.11.Final; < 2.2.30.Final), Snyk (< 2.2.30.Final; >= 2.3.0.Alpha1, < 2.3.11.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1459",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:14d7c218-7610-5586-b840-35ee83506b03",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1459 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2024-1459 (path traversal via \"/..;\" segment) is NOT present in target version 2.2.37.Final. The upstream fix (commit 40bb3314f013247af8e222870bd5045ca8650c5c by Red Hat) was already included in the upstream release 2.2.37.Final when TuxCare onboarded it. The fix adds pathSubState tracking to prevent semicolons within dot-segments from being stripped, ensuring \"/..;\" is NOT treated as \"/..\"...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1635",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7eabaa1f-55b8-583e-baef-f249df4062c8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1635 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. The target Undertow 2.2.37.Final is NOT affected by CVE-2024-1635. The vulnerability describes a resource leak where WriteTimeoutStreamSinkConduit fails to cancel timeout tasks when connections close during protocol upgrade, causing memory and file descriptor exhaustion. The upstream fix (commit e824766df by Flavia Rainone <frainone@redhat.com>) was already present in the upstream 2.2.37.Final release before TuxCare onboarding. All defensive changes are present in the target: close listener with synchronized handle cleanup (lines 85-94), volatile handle field (line 50), and synchronized operations in all handle manipulation methods. The vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Final, < 2.3.12.Final; < 2.2.31.Final), cve.org (= 1.31.0), Snyk (< 2.2.31.Final; >= 2.3.0.Final, < 2.3.12.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-3653",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6ff7c41d-0a56-5525-91ad-9be04f142697",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-3653 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 Target is Undertow 2.2.37.Final (TuxCare ELS branch 2.2.37.Final.tuxcare, HEAD c85edf915). CVE-2024-3653 is a remote memory-exhaustion DoS in LearningPushHandler: the pre-fix handler stored learned push resources in unbounded maps, so an attacker sending normal HTTP requests with many distinct paths/referrers could grow the cache without limit (default maxAge=-1 meant entries never expired and nothing capped the entry count). The upstream fix (UNDERTOW-2382) replaces the unbounded map with a bounded LRUCache<String, LRUCache<String, PushedRequest>> (default 200 entries) and makes max-entries/max-age configurable via system properties. This fix is ALREADY PRESENT in HEAD: LearningPushHandler.java:49-52,66,73 construct the bounded LRUCache, and LRUCache.add() (LRUCache.java:101-107) evicts the least-recently-used entry whenever cache.size() > maxEntries \u2014 bounding memory regardless of maxAge=-1. The fix commits 6d674f068 and 1da86edbd are ancestors of HEAD and, critically, ancestors of the upstream release base 4d04ea707 \"Prepare 2.2.37.Final\". They are authored by upstream maintainers (frainone@redhat.com, baranowb@gmail.com), NOT TuxCare. The TuxCare merge in HEAD (JAVAELSCVE-838) only edited core/pom.xml and did not touch the handler. Therefore the vulnerable pattern is not present; this is an upstream fix inherited from the shipped release \u2192 not_affected / code_not_present (not already_fixed, since no TuxCare-authored backport installed it). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-3884",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:be01f1c2-1218-5c68-8d31-e0f3ccf88482",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-3884 affects version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4027",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:520bb5c3-8f2f-5473-80ff-373f6cdfdf54",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4109",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:86dd3d46-18aa-54a0-82b0-1fa340db758c",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.2.37.Final-tuxcare.2."
      }
    },
    {
      "id": "CVE-2024-5971",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:87c22d57-379f-502b-a9b7-de414b13b25d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-5971 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 Target Undertow 2.2.37.Final already contains the upstream fix for CVE-2024-5971. The vulnerability is a chunked-response hang: in SslConduit.wrapAndFlip() the SSLEngine.wrap loop could run multiple iterations (handshake-interleaved wraps, notably Java 17 TLSv1.3), but only the LAST iteration's SSLEngineResult was returned. Its bytesConsumed() under-reported the total application bytes actually consumed, so the write layer believed the body was not fully written and never emitted the chunked 0\\r\\n terminator \u2014 the connection hangs, causing uncontrolled resource consumption / DoS. The fix accumulates totalConsumedBytes across all wrap iterations and, if the final result's bytesConsumed differs, reconstructs the SSLEngineResult with the correct total so the write completes and the response terminates. HEAD's SslConduit.java (lines ~1002-1019) contains this fix verbatim. The fix commit 6742d8333 (\"[UNDERTOW-2413] CVE-2024-5971 ...\") is authored by Flavia Rainone <frainone@redhat.com>, a cherry-pick of upstream GitHub commit 74fdf630, and is an ancestor of the upstream \"Prepare 2.2.37.Final\" tag \u2014 i.e. shipped by upstream Red Hat before TuxCare onboarded the version. Verdict: not_affected (upstream/vendor fix already baked in), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-6162",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dccde986-6679-52e6-a306-2993de6dd0be",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-6162 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. The target (Undertow 2.2.37.Final) is NOT affected by CVE-2024-6162. The vulnerability (shared decodeBuffer StringBuilder causing path confusion in concurrent AJP requests) was fixed in upstream commit a28ac53076e2fa532266d25e0c0b1a01d0e9d2cf by Red Hat engineer Tomas Hofman. This fix was already present in the upstream 2.2.37.Final release before TuxCare onboarded it. The vulnerable code pattern (decodeBuffer as instance field) is absent; the fix code (decodeBuffer as local variable) is present at line 518 of AjpRequestParser.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.14.Final; < 2.2.33.Final), cve.org (< 2.2.33.Final; >= 2.3.0.Alpha1, < 2.3.14), Snyk (< 2.2.33.Final; >= 2.3.0.Final, < 2.3.14.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-7885",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4a11a149-1909-513d-b10b-e849376e6cf6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-7885 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core. The upstream fix was released in 2.2.36.Final, and version 2.2.37.Final is a later release of the same line. Advisories: GitHub GHSA-9623-mqmm-5rcf (fixed in 2.2.36.Final), CVE record (fixed in 2.2.36.Final), Snyk (fixed in 2.2.36.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-12543",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:226db48b-99af-59e6-b2ef-85ff3f8abd7c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-9784",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:53360734-14e7-5186-95c3-1d121c43933a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28367",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d195a6aa-6c72-53fa-9e53-01b2517b50a5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28367 affects version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28368",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a3bb76c2-8257-5d0c-984a-4084b5e5fb0f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28368 affects version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28369",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2026bb70-0556-5578-9130-34184745fe7d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28369 affects version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-3260",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4cd78d5b-2ee7-5e96-b36a-fe0951248b2f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-core@2.2.37.Final-tuxcare.2"
    }
  ]
}