{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:105c316e-68c8-54e5-a397-65ae06f1e68a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1", "version": "2.1.4.Final-tuxcare.1", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.1.4.Final", "type": "library", "group": "io.undertow", "version": "2.1.4.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bce9ddb6-3c11-58a4-912c-6ceb1dd0f90c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 is NOT present in Undertow 2.1.4.Final. The directory traversal vulnerability affecting versions before 1.0.17, 1.1.0.CR5, and 1.2.0.Beta3 was fixed in upstream commit 28f244e63 by Stuart Douglas in October 2014. This fix introduced PathSeparatorHandler and added File.separator checks in ResourceHandler, DefaultServlet, and ServletPathMatches to block/normalize backslash character...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e3223be8-6cb5-51b1-a2d2-f790a97c3e56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 (UNDERTOW-835) fix for BufferOverflowException on long URLs is already present in the target repository. The fix was authored by upstream Undertow developer Stuart Douglas and shipped in the upstream 2.1.4.Final release that TuxCare onboarded. The vulnerable code pattern (unbounded buffer write of long request lines) is not present in the target at SHA 3ef8ad2816d9.", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1adf48cc-e74e-565c-b3d7-d4cb800bd75a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.1.4.Final) is NOT affected by CVE-2017-12165. The fix for this HTTP request smuggling vulnerability was already present in the upstream 2.1.4.Final release that TuxCare onboarded. All validation mechanisms introduced by the vendor's JBEAP-9909 patches are present at HEAD, including strict RFC 7230 token validation for header names and methods, request target ch...", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:26804335-49a0-5c1e-ace0-f110022983e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is NOT present in Undertow 2.1.4.Final. The vulnerability required URI validation in Digest authentication, which is fully implemented in the target code (DigestAuthenticationMechanism.java lines 235-259). The fix was authored by Stuart Douglas (upstream) and shipped in the original 2.1.4.Final release before TuxCare onboarded it. The target version (2.1.4.Final) is newer than th...", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e2c1d7d5-864e-561a-be9e-0466efd37748", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 is not present in Undertow 2.1.4.Final. The vulnerability was fixed by upstream vendor commits 1e72647818c9fb31b693a953b1ae595a6c82eb7f (JBEAP-9909) and 3436b03eda8b0b62c1855698c4d7c358add836c2 (UNDERTOW-1165), both authored by Stuart Douglas and shipped in the upstream 2.1.4.Final release before TuxCare onboarding (commit 5ce40bc207537a6a6dab50bbf768d8a02cc1c10d). All required de...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b8961ff8-6145-59e0-af23-97b8ff6ece1b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2670 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2017-2670 is NOT present in the target. The vulnerability (infinite loop on non-clean WebSocket TCP close) was fixed by upstream commit 9bfe9fbbb in AbstractFramedStreamSourceChannel.java, which added STATE_STREAM_BROKEN to the loop exit condition. This fix was already present in Undertow 2.1.4.Final when TuxCare onboarded it (911 commits before onboarding). The target code at line 301 shows the patched condition: allAreClear(state, STATE_CLOSED | STATE_STREAM_BROKEN), preventing infinite loops when connections break uncleanly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a27d58aa-014b-5dc2-9db6-5bd05af80658", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 affects Undertow versions before the fix was applied in March 2017. The target version 2.1.4.Final (released later) already contains the upstream fix (commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f - JBEAP-9909) which introduced the ALLOWED_TARGET_CHARACTER validation array. This array validates all characters in query strings and path parameters at three critical parsing points ...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6569206a-53eb-5bf7-b8ba-336ac190620c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 describes a file descriptor leak in Undertow's URLResource.getLastModified() when processing JAR protocol URLs. The vulnerable code called JarURLConnection.getLastModified(), which opens file descriptors that remain open until garbage collection, leading to descriptor exhaustion under load. The upstream fix (commit 882d5884f by Norito Agetsuma, April 2018) was already present in U...", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:eb6510ad-ede1-5610-989a-493764d3e782", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-14642 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 (UNDERTOW-1412) is NOT present in the target. The vulnerability was an information leak where HttpResponseConduit would write uninitialized buffer array slots when flushing multi-buffer responses, potentially exposing data from previous requests. The fix was applied by upstream Undertow in commit a83b047d5 on 2018-09-13, which changed line 150 from `next.write(data, 0, data.lengt...", "justification": "code_not_present" } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ca4c6df6-d617-525c-b8f5-a1d7d2796484", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-10212 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2019-10212 is NOT present in the target. The vulnerability involved credential exposure in DEBUG logs where BasicAuthenticationMechanism logged plaintext credentials (username:password) and base64-encoded credentials, plus HttpServerExchange.toString() included request/response headers. Both fixes were already present in the upstream Undertow 2.1.4.Final release that TuxCare onboarded. The target code at HEAD contains the fixed versions: BasicAuthenticationMechanism logs only metadata without credential values (lines 154, 156), and HttpServerExchange.toString() excludes headers (line 2458).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9eea84e3-fe33-52c2-8879-ccc73c9e6f62", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-14888 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. Version 2.1.4.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vjxc-frw4-jmh5 (affected below 2.0.29.Final), NVD (affected up to 2.0.28), CVE record (affected below 2.0.28.SP1), Snyk (affected below 2.0.29.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:49275150-116a-57f8-a31c-1a3136dcabcd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3888 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2019-3888 affects Undertow web server before 2.0.21, causing plaintext credentials to be exposed in log files when HttpServerExchange objects are logged during error handling. The target repository is Undertow version 2.1.4.Final, which already contains the upstream fixes (UNDERTOW-1515 and UNDERTOW-1576) that were shipped in the upstream release. These fixes remove headers from HttpServerExchange.toString() output and remove credential data from debug logging. Both fix commits (20cacc96c by Carter Kozak and 8b63e258 by Paramvir Jindal) are ancestors of the TuxCare onboarding commit, confirming they were present in the upstream 2.1.4.Final release before TuxCare maintenance began. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5d48fd92-7cb8-5c6b-9747-78c988da7b7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d97cf9e0-d44b-5abc-bbfb-5d16772ad0bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10705 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. Target Undertow 2.1.4.Final is NOT AFFECTED by CVE-2020-10705. The vulnerability (buffer leak in Expect: 100-continue handling leading to OOM) was fixed in upstream Undertow 2.1.1.Final (released April 2020) per the CVE description \"before Undertow 2.1.1.Final\". All UNDERTOW-1657 fixes (ResponseCommitListener, terminateRequest calls, freeContinueResponse buffer cleanup, EXPECTATION_FAILED handling, extra-bytes cleanup) are present in the target code. These fixes shipped in the upstream 2.1.4.Final release that TuxCare onboarded, not as a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2fc49ae3-c7ad-5c42-b880-044143764522", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10719 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 (HTTP request smuggling via chunked encoding integer overflow) is not present in target Undertow 2.1.4.Final. The fix was already included in the upstream 2.1.4.Final release that TuxCare onboarded. The vulnerability allowed attackers to send excessively large chunk size values causing integer overflow during left-shift operations in ChunkReader.readChunk(), enabling HTTP request...", "justification": "code_not_present" } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b307e160-e5fe-5e46-a12c-b59a2b258972", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1745 does not affect version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2020-1745 affects Undertow's AJP connector through arbitrary request attribute injection. The target version 2.1.4.Final shipped with the upstream fix (commits e60e04f4e and b976853c8) that validates unknown AJP attributes against a whitelist. The vulnerable code path that unconditionally accepted arbitrary attributes has been removed. Unknown attributes are now silently ignored unless they match the predefined ATTR_SET or an optional configured pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).", "justification": "code_not_present" } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9d86daf5-242c-5636-a32b-1fd3edb246f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4b9ee077-8200-5f81-9a77-248a51f1de3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f5aadfc4-ec2b-5ad0-8376-92fca0486a13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bbdef7e3-e0ea-5ef9-8f3d-903227a5be08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9fc2eac3-196f-5c90-942f-1f7f046683fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8db5befe-4bda-57d4-8903-23cc33b72d26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c5352dad-bfc3-59c7-81ee-ca3b4a05a4cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6e6b197a-4180-5c1f-9348-72ad696e1c93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:52f2da2e-f134-5253-af28-4e14b8a98a58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1319 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:056e8b09-f9dc-5011-9682-98ff5c7fa161", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2022-2764", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5ffcdf67-d19e-5dc8-90f2-34cb07d0797a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2764 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:90dcd5dd-2c82-5682-92fe-dc0485390ff5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core, and is fixed in 2.1.4.Final-tuxcare.2." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:69134b14-19a0-5f42-b36c-9614a24538ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0e298639-495c-5856-bc05-55b9b318ddcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d3902ce9-24c0-5c0b-9871-0e1b3ee975af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:47fc2f26-63aa-58ff-b3cd-8e8ce89dfd3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:31c0f58d-94cf-5ddd-b26e-ccadda81a36f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d3a8b0ff-c746-519a-91c7-27e958b34745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c905ff12-e6ff-515b-a6e1-051e24c9169c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d257c443-21da-5c64-acec-12faa1d56807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e23590e5-3b8e-5d5b-b5f9-1cef4a24980f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.1.4.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f3da739d-fc63-583f-84a5-ba8efac8d84a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e6f59651-34dc-5150-8c7c-576e68dcd65d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6162 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a40b4adb-4ac9-5f4d-9be4-aca1c3e8566c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b8cc6021-2409-5797-ba10-f8bb36770f94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5e6d5347-4990-5088-9f1b-d69a2dfcf007", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3b158df0-819d-525d-9c80-2458ca3e367a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:60019dc6-4518-50db-a69e-4c1e17bd0d73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5d0dda16-130c-5a28-a18e-c0f497090e2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d0fec577-ed90-5196-87d9-b2a774672e15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.1.4.Final-tuxcare.1 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.4.Final-tuxcare.1" } ] }