{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3f8b06e0-158c-5425-9aeb-4eb6159e4537",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-core",
      "purl": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2",
      "version": "2.0.32.Final-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-core",
            "purl": "pkg:maven/io.undertow/undertow-core@2.0.32.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.0.32.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-7816",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:74a63e7f-f17e-5686-a8fc-b9b76109958f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-7816 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 affects Undertow versions 1.0.x-1.2.x. The target version 2.0.32.Final already contains the upstream fix (commit 28f244e63 from 2014-10-28) that was shipped in the upstream release. All defense mechanisms are present: PathSeparatorHandler normalizes backslashes to forward slashes on Windows, ResourceHandler/DefaultServlet/ServletPathMatches reject URIs containing platform-specific...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-7046",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:90c1ae89-6802-5ada-82dd-ecbc65568872",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-7046 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 (UNDERTOW-835) is NOT present in the target. The vulnerability\u2014BufferOverflowException when handling long URLs in proxy requests\u2014was fixed by upstream commit c518b5a17 authored by Stuart Douglas. This fix was already present in Undertow 2.0.32.Final before TuxCare onboarded the version. The target contains all three components of the upstream fix: (1) HttpRequestConduit.java's len...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12165",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:82548690-d1ef-5af7-a8b5-b399dab16412",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12165 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.0.32.Final is not affected by CVE-2017-12165. The vulnerability pattern (processing HTTP headers with invalid characters and allowing multiple Content-Length/Transfer-Encoding headers) is not present because the upstream vendor fix was already included in the 2.0.32.Final release before TuxCare onboarded this version. All defensive code from the vendor patches is present a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12196",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c602d277-5133-5890-bd87-9a8e1d6aad6c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12196 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196: Target version 2.0.32.Final is NOT AFFECTED. The vulnerability was fixed by upstream Undertow maintainer Stuart Douglas in commits facb33a5c (Oct 2017) and 8804170ce (Dec 2017), which added URI validation to the Digest authentication mechanism. These fixes were already present in the upstream 2.0.32.Final release that TuxCare onboarded. The vulnerable pattern (missing URI valida...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-2666",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2bfecb6e-3fe9-56e2-bacf-579bd2de23c7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-2666 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 is NOT present in this target. The vulnerability (HTTP request line parsing accepting invalid characters, enabling HTTP response splitting/smuggling attacks) was fixed by upstream Undertow developers in commits 1e72647818 (JBEAP-9909) and 3436b03ed (UNDERTOW-1165), which shipped in the upstream 2.0.32.Final release. TuxCare onboarded this version with the fixes already present. Al...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-2670",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6fb6d6f2-052f-5fc1-a141-6eb247cdb737",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-2670 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2017-2670 (UNDERTOW-1035) affects Undertow before 1.3.28, causing infinite loops in IO threads on non-clean WebSocket TCP close. The target repository is Undertow 2.0.32.Final, which already contains the upstream fix (commit 9bfe9fbbb by Stuart Douglas, dated 2017-06-13). This fix was present in the upstream 2.0.32.Final release when TuxCare onboarded it. The vulnerable code pattern (loop without STATE_STREAM_BROKEN check) is not present. The fix ensures the data processing loop exits when the stream is broken, preventing infinite loops.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7559",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:59d9a936-854f-53ca-b73c-cd3e67128437",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7559 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 Target version 2.0.32.Final (released September 2020) already contains the complete fix for CVE-2017-7559 in the upstream release. The vulnerability affected versions before 2.0.0.Alpha2, but the fix was applied in August 2017 (commit 3436b03ed, UNDERTOW-1165) and is present in the onboarded version. Character validation via ALLOWED_TARGET_CHARACTER is active by default in handlePath(), handleQ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1114",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:25970bf2-5eb5-5deb-8bf0-40de059b511b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1114 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository already contains the fix for CVE-2018-1114. The vulnerability was a file descriptor leak in URLResource.getLastModified() when handling jar: protocol URLs - calling JarURLConnection.getLastModified() holds file descriptors open until finalization, causing resource exhaustion. The fix (commit 882d5884f) was shipped in upstream Undertow 2.0.32.Final and was already present w...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-14642",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:08387577-ea5c-5f16-909a-3aba29e9e0bc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-14642 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 (UNDERTOW-1412) is not present in this target. The vulnerability involved an information leak where HttpResponseConduit would write the entire writevBuffer array (data.length elements) instead of only the filled portion (length + 1 elements), potentially leaking stale data from previous requests. The fix changed line 150 from `next.write(data, 0, data.length)` to `next.write(data...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-10212",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6d557e94-509b-50b9-b240-6f2e4e22bf59",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10212 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.0.32.Final) is NOT AFFECTED by CVE-2019-10212. The upstream vendor fixes for this vulnerability were already included in the 2.0.32.Final release that TuxCare onboarded. Two upstream commits address the credential logging issue: (1) UNDERTOW-1576 (8b63e2585) removes plaintext credentials from debug logs in BasicAuthenticationMechanism, and (2) UNDERTOW-1515 (20cacc96c) removes headers from HttpServerExchange.toString(). Both fixes are present in the target code, eliminating the vulnerable patterns where credentials could be exposed in debug logs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-14888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6bc78203-e5b4-5d22-a8f1-bc869d1e7580",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14888 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. The upstream fix was released in 2.0.29.Final, and version 2.0.32.Final is a later release of the same line. Advisories: GitHub GHSA-vjxc-frw4-jmh5 (fixed in 2.0.29.Final), NVD (last affected 2.0.28), CVE record (fixed in 2.0.28.SP1), Snyk (fixed in 2.0.29.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-3888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a2b421cd-41a4-5a41-b925-5624a4f09b6b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3888 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-3888 affects Undertow before 2.0.21. The target is version 2.0.32.Final, which includes both required upstream fixes: (1) UNDERTOW-1515 removed headers from HttpServerExchange.toString() to prevent Authorization headers from being logged, and (2) UNDERTOW-1576 removed plaintext credentials from BasicAuthenticationMechanism debug logs. Both fixes were committed upstream in 2019 and are present in the 2.0.32.Final release that TuxCare onboarded. The vulnerable code patterns (logging credentials via toString() or explicit debug statements) are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10687",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:19f75a0b-7372-50e8-827d-1b6cb7d6f4fb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10687 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-10705",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:328143dc-e6ef-54a2-9909-250a6a721337",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10705 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-10719",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b00152b0-8814-5c4a-8584-197a17a3f0f0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10719 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 (HTTP request smuggling via chunk size overflow) is NOT present in Undertow 2.0.32.Final. The fix was already included in the upstream release before TuxCare onboarded it. The vulnerability required unbounded accumulation of hexadecimal chunk size values causing integer overflow. The target contains the upstream fix: a LIMIT constant (Long.MAX_VALUE >> 4) and overflow validation ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1745",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:47acf7df-a261-56e7-86d4-358e02b79efa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1745 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core. Target version 2.0.32.Final is NOT affected by CVE-2020-1745. The upstream vendor (Red Hat) fixed this AJP file inclusion vulnerability in commit e60e04f4e9bab49f406c8c57770c4a1bbbc37067 (UNDERTOW-1667), which was already part of the upstream 2.0.32.Final release before TuxCare onboarded it. The fix adds validation to reject unknown AJP request attributes unless they match a known-safe set (ATTR_SET) or an administrator-configured regex pattern. The default configuration is secure-by-default (pattern=null), silently dropping all unknown attributes. The vulnerable code pattern (unconditional acceptance of arbitrary AJP attributes) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1757",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:43457087-c435-513b-9fb3-9bd6978e6a2f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1757 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-27782",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6f1c7b63-0122-549a-a003-4b4199f62396",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27782 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2021-20220",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:78a9d3ae-b542-5721-a827-0ed150e4cb60",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-20220 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2021-3597",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7e2f0ada-da78-5ff0-9984-541ad2272f04",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3597 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2021-3629",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:42d73935-8d76-5609-8c2f-6527b1502a98",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3629 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2021-3690",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3792649f-d12d-59a0-8cf0-3e4053387f57",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3690 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2021-3859",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0fcf14d4-e55f-56cb-8d05-14fd1e47a51a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3859 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2022-2053",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5e3dcbc7-037b-5834-a590-ab6c8f21bebd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2053 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2022-4492",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1f8c91d8-a747-5bc2-9c72-69d2d2105982",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-4492 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-1108",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c22f8ca5-7a91-5570-9967-351c1d593eba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-1108 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-1973",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f8df2dae-c731-57b3-911e-c10da06a9e51",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-4639",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:262fae48-6bb9-5e1b-b678-bd2d505cbde6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-1459",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4b110875-83be-5218-8865-34f77f59d829",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-1635",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7cb6cbc0-a846-591e-9cdb-fd0835e0665a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-3653",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7bd367f5-16b5-51d9-bf86-1aa28b80f579",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-3884",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:429e45b1-42bc-56e1-a37a-e2e6bf4cf797",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-3884 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4027",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1d104718-392f-5d79-8231-d2e43a1f3cdc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4109",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:97c38518-f714-5fda-83c2-2deeab84053c",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.0.32.Final-tuxcare.2."
      }
    },
    {
      "id": "CVE-2024-5971",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bfe553fe-0d30-5e2a-824a-00318fd9e06d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-6162",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bd7db2e1-5440-5b78-af60-91b8697fee65",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6162 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-7885",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7fb87bda-0633-58b5-9175-4fad7140e41a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-12543",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c7f40592-507c-5b75-8743-c51d077ac3b9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-9784",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1d5e316e-63b1-59e7-ac94-a8e87286fe4c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28367",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c336fe8e-e2d4-554a-adeb-6b7927f0079d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28367 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28368",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1c19b620-e848-541c-bf07-7882a486bcf5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28368 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28369",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:05df8842-e366-5ed7-a100-36398238c077",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28369 affects version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-3260",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d2a05407-6852-57c1-977a-2999a30390e8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-core@2.0.32.Final-tuxcare.2"
    }
  ]
}