{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9799a1b8-7dc3-5513-91bd-f26cf4f3a849", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3", "version": "2.0.26.Final-tuxcare.3", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.0.26.Final", "type": "library", "group": "io.undertow", "version": "2.0.26.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:9a100810-d1a4-5ecd-a3ec-21ab65fa9a8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 is NOT present in Undertow 2.0.26.Final. The vulnerability (directory traversal via backslashes in URLs on Windows) was fixed in October 2014 by upstream commit 28f244e63 (UNDERTOW-338), which shipped in the 2.0.26.Final release before TuxCare onboarded it. The defense code that rejects paths containing backslashes on Windows systems is present and active in all resource-serving h...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:da2faad6-df08-5867-b4aa-5d4c54e36148", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.0.26.Final) is not affected by CVE-2016-7046. The vulnerability fix (UNDERTOW-835) addressing BufferOverflowException on long URL proxy requests was already included in the upstream 2.0.26.Final release that TuxCare onboarded. All three components of the fix are present in HEAD: (1) incremental URL writing via STATE_URL state in HttpRequestConduit.java, (2) ove...", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:d5196518-c115-5c75-85a7-b683e555f561", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12165 is not present in Undertow 2.0.26.Final. The vulnerability affects \"Undertow before 1.4.17, 1.3.31 and 2.0.0\" according to the CVE description. The fix (JBEAP-9909) was introduced by Stuart Douglas (upstream vendor) on 2017-06-08 in commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f and first shipped in 2.0.0.Beta1. The target version 2.0.26.Final includes this fix as part of its up...", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:c7c9ab0b-fc7d-57c8-b208-3caaeca6237f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196: Undertow 2.0.26.Final is NOT AFFECTED. The Digest authentication URI validation fix was already present in the upstream release. The vulnerable code pattern (missing URI validation allowing MITM attacks) does not exist in the target because the fix (commits facb33a5c and 11b6f0e00) was authored by upstream maintainer Stuart Douglas and shipped in Undertow 2.0.26.Final before Tux...", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:6181526b-e4e5-578a-9ccf-f560898825cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 is NOT present in this target. The vulnerability involves HTTP request smuggling via invalid characters in request lines and headers. The complete upstream fix (commits 1e72647818 and 3436b03eda8) was already included in Undertow 2.0.26.Final when TuxCare onboarded it. All defense mechanisms are present and active by default: ALLOWED_TOKEN_CHARACTERS validation for methods/headers...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:3298771f-52e3-5b55-a4ae-6c141060904f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2670 does not affect version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core. The target repository (Undertow 2.0.26.Final) is not affected by CVE-2017-2670. The vulnerability, which causes infinite loop on IO threads during non-clean WebSocket TCP close, was fixed upstream by Stuart Douglas in commit 3ad7537d on April 4, 2017. The fix adds STATE_STREAM_BROKEN check to the loop termination condition in AbstractFramedStreamSourceChannel.java line 288. Since the CVE affects versions \"before 1.3.28\" and the target is version 2.0.26.Final (much newer), the fix was already present when TuxCare onboarded this version. The vulnerable code pattern (loop without STATE_STREAM_BROKEN check) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:e302b405-31ee-5ef7-b070-cb46363279c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 affects Undertow 2.x before 2.0.0.Alpha2. The target version 2.0.26.Final includes the upstream fix from commit 1e72647818 (2017-03-30), which introduced character validation in HttpRequestParser to reject invalid characters in query strings and path parameters. The fix validates all characters against an ALLOWED_TARGET_CHARACTER array, rejecting control characters (< 32, includin...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:08810777-4941-5d23-baa0-19487bcbc22f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.0.26.Final) is NOT affected by CVE-2018-1114. The file descriptor leak vulnerability in URLResource.getLastModified() for jar protocol URLs was fixed upstream in April 2018 (commit 882d5884f) and shipped with all 2.0.x releases from 2.0.10.Final onwards. The target version 2.0.26.Final contains this upstream fix, which avoids calling JarURLConnection.getLastMod...", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:11641033-05f7-58d3-af0c-06bd986ca309", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-14642 does not affect version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 is not present in this target. The vulnerability was an information leak where Undertow's HTTP response buffer flushing code would write the entire pre-allocated buffer instead of just the valid data, potentially exposing data from previous requests. The fix was included in upstream Undertow 2.0.17.Final (released September 2018) and is present in the target version 2.0.26.Final....", "justification": "code_not_present" } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:9d2dd3ff-554b-5806-a7ca-1a44a9a3f73b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10212 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:c938597e-d408-57e5-a416-7359b05e2b82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:44620040-c54c-5e12-9e04-14e4ce8f3236", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3888 does not affect version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core. CVE-2019-3888 describes credential exposure when Connectors.executeRootHandler logs HttpServerExchange at ERROR level, which calls HttpServerExchange.toString(). The vulnerability exists when toString() includes request/response headers containing credentials. The target at version 2.0.26.Final already has the fix (commit 20cacc96c) which removes headers from toString(). This upstream fix was included in the 2.0.26.Final release prior to TuxCare onboarding, making the target not affected by this specific CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:3bc10f76-b559-50fa-86aa-cb9ff134a963", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:5bf8ba62-572d-5891-9bfa-04ac2967491f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:e2471586-6c88-5512-a3b9-cc572f2e3cfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:42d33d5e-aea5-5330-a559-c8743a6d7563", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:7065e0ee-d2ba-5f82-9e5c-885f6d42ce17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:5062e0e4-cad0-51d6-9244-7239adedcc92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:48e222fa-8c38-5133-ac6b-c225e9c59ae2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:4a164cd5-32ee-5a3b-a2e8-d1b68308fea9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:17dc6b8d-e231-57b3-9bf6-7fce3654fdb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:ff2542d1-3a49-5428-9364-7465c4ec7403", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:71017c63-1b1d-5353-a4e5-866a9838f52a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:89d2bdea-6f6d-531b-b6c3-5c8cea164d48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:b7f22cde-2d6b-5bda-81c6-4b93302a11cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core, and is fixed in 2.0.26.Final-tuxcare.4." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:317b4d6e-314c-5a81-93c3-852d2766d119", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:fcb0ee4e-9e41-5c9d-860b-4153a604d02b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:50ae3223-478c-5eae-9481-add884e1308a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:4dccb978-e9d1-5585-834b-4e35775fa009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:2dae7f6d-e412-5f0f-aebc-00c4bf3b980d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:de8df9d3-ebec-565d-a991-9841a29a74bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:60a04db5-64a3-5f54-8bbf-543de84a58ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:efb442bf-2ba1-523c-9763-17eab7f8a619", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:a1421c60-12d4-5a0e-ab9d-bcfda7ad4f47", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.0.26.Final-tuxcare.3." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:ad455ac3-680b-5d05-843a-fb73fe56e905", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:aaa2e0f4-659f-5762-962d-ea009915c71c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6162 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:54c6022e-0333-510b-aae1-df056e0a455f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:b7001ff6-8920-51d9-9793-690d50418ca1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:6612cbca-28ac-53c0-8d72-8e9fa30fcd51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:57e4bbdc-892a-5f74-bc50-7f70b77c3bc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:827ff843-78dc-5945-9582-b00d4a54f70e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:9e5d29c8-a51e-533e-b6e4-b5be234ba312", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:be196e14-641f-55d8-9dfa-d59f359f8c64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.0.26.Final-tuxcare.3 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.0.26.Final-tuxcare.3" } ] }