{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8060097d-ee6c-50b6-8101-0a68cf07cc31", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2", "version": "2.1.7.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.1.7.Final", "type": "library", "group": "io.undertow", "version": "2.1.7.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:122df5f5-c1cb-5f18-8506-1ce831230cc9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 is NOT present in the target. The directory traversal vulnerability on Windows systems was fixed by the upstream vendor (JBoss/Red Hat) in commit 28f244e63 by Stuart Douglas, and this fix was already included in Undertow version 2.1.7.Final when TuxCare onboarded it. The target code contains all defensive measures: PathSeparatorHandler for separator normalization, File.separator c...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:851eec16-d8f6-5506-b982-73fbab6fda85", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 (UNDERTOW-835) is NOT present in target version 2.1.7.Final. The vulnerability (BufferOverflowException from long URLs) was fixed in upstream commit c518b5a17 by Stuart Douglas and shipped in the 2.1.7.Final release. All three fix components are present: (1) HttpRequestConduit pre-flight buffer capacity check with incremental URL writing via STATE_URL, (2) HpackEncoder overflow bu...", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:395a9bbf-62e4-5009-99da-5253e5d8a672", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.1.7.Final is not affected by CVE-2017-12165. The upstream vendor fix for this HTTP request smuggling vulnerability was already present in the 2.1.7.Final release when TuxCare onboarded it. The fix (commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f by Stuart Douglas) adds three defense mechanisms: (1) RFC 7230 token validation for HTTP methods and header names via ALLOWED_TOK...", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f369c929-e66d-57ad-b950-03846c1cd068", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is NOT present in Undertow 2.1.7.Final. The vulnerability (missing URI validation in Digest authentication) was fixed in upstream commits facb33a5c and 11b6f0e0 (UNDERTOW-1190), which were already included in the upstream 2.1.7.Final release before TuxCare onboarding. The fix validates that the URI field in the Digest Authorization header matches the actual HTTP request URI, reje...", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6f1ee5b6-eaa3-5913-aef3-bb0311464196", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 fix was already present in upstream Undertow 2.1.7.Final release. The target contains commit 3436b03ed (UNDERTOW-1165) which implements comprehensive HTTP request smuggling protections including: (1) RFC 7230 token validation for HTTP methods and headers, (2) request-target character validation rejecting control chars and delimiters, (3) validation ensuring at most one Content-Len...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:340aa4b0-0f91-575e-9644-fd81bafb9a0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2670 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. Target Undertow 2.1.7.Final is not affected by CVE-2017-2670. The vulnerability affects \"Undertow before 1.3.28\" and causes infinite loops on IO threads when WebSocket connections experience non-clean TCP close. The fix (adding STATE_STREAM_BROKEN check to loop exit condition) was applied upstream in June 2017 by Stuart Douglas and shipped in the 2.1.7.Final release that TuxCare onboarded. The vulnerable code pattern is not present - the loop at line 301 correctly checks for both STATE_CLOSED and STATE_STREAM_BROKEN, preventing infinite loops.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b69f4731-a766-5e84-8916-0a29dfcb2e62", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 affects Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final. The target version 2.1.7.Final is significantly newer (released after 2.0.0.Final in February 2018) and contains the complete upstream fix. Character validation for query strings and path parameters was added by JBEAP-9909 (March 2017) and refined by UNDERTOW-1185 (November 2017). T...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cb5afaf2-d556-5e6d-a26c-4ac5a93108f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 is NOT present in this target. The vulnerability concerned a file descriptor leak in URLResource.getLastModified() when processing JAR URLs. The fix was already included in the upstream Undertow 2.1.7.Final release (committed April 24, 2018) before TuxCare onboarded this version (October 5, 2026). The fix modifies the openConnection() method to handle jar:// protocol URLs speciall...", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:32eff121-3486-53fb-a0b4-5509780d54b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-14642 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 (information leak via buffer over-write) is NOT present in target version 2.1.7.Final. The vulnerability was fixed in upstream commit a83b047d5 (September 2018) by Stuart Douglas, which was already included in the upstream 2.1.7.Final release that TuxCare onboarded. The fix changes line 150 in HttpResponseConduit.java from writing the full buffer array length (data.length) to wri...", "justification": "code_not_present" } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:58ba5834-37be-555b-86d7-ffdbd7e06ea3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-10212 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-10212 affects Undertow versions below 2.0.20 where DEBUG logging exposed user credentials. The target version 2.1.7.Final already contains upstream fixes UNDERTOW-1576 (commit 8b63e258) and UNDERTOW-1515 (commit 20cacc96c) that shipped with the 2.1.7.Final release. These fixes remove plaintext credentials from debug log statements in BasicAuthenticationMechanism and remove headers from HttpServerExchange.toString(). The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ffb16183-9c67-51e5-9719-b5a97fb0918e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-14888 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. Version 2.1.7.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vjxc-frw4-jmh5 (affected below 2.0.29.Final), NVD (affected up to 2.0.28), CVE record (affected below 2.0.28.SP1), Snyk (affected below 2.0.29.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:91996f1e-db60-5da1-91de-3ff1732751ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3888 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-3888 is NOT present in Undertow 2.1.7.Final. The vulnerability involved credential exposure through logging when HttpServerExchange.toString() included request/response headers. The upstream fix (commit 20cacc96c by Carter Kozak) removed headers from toString() output, and this fix was already present in the 2.1.7.Final release that TuxCare onboarded. The target's HttpServerExchange.toString() returns only method and URI (line 2458), not headers. Additionally, BasicAuthenticationMechanism does not log plain credentials (lines 154, 156). Both fixes were shipped in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:89a7fe1b-6fc5-5a5b-b8c4-6e6a611324e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10687 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 Target Undertow 2.1.7.Final is not affected by CVE-2020-10687. The upstream release already includes all fixes for HTTP request smuggling via invalid character validation. Both HTTP/1.x and HTTP/2 request components (method, path, scheme, authority, headers) are strictly validated against allowed character sets, preventing the smuggling attack described in the CVE.", "justification": "code_not_present" } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3bd78def-d7c6-5729-80ef-bb0c82d0d065", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10705 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-10705 (UNDERTOW-1657) is not present in target version 2.1.7.Final. The vulnerability involves buffer leaks when handling HTTP requests with \"Expect: 100-continue\" headers, potentially causing out-of-memory errors. All three upstream fix commits (64bbaeb7c, aa5e1fe11, b53d4589c) from Feb-Apr 2020 were already included in upstream Undertow 2.1.7.Final (released March 2021) before TuxCare onboarded it. The defensive code is verified present: ResponseCommitListener in HttpContinueReadHandler, freeContinueResponse() in HttpResponseConduit, extra bytes cleanup in HttpReadListener, and EXPECTATION_FAILED handling in HttpTransferEncoding. CVE states versions before 2.1.1.Final are affected; target 2.1.7.Final is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8da05671-3eb3-5a5c-846e-0ba854a533a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10719 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 is not present in the target. The vulnerability (integer overflow in HTTP chunk-size parsing enabling request smuggling) was fixed by the upstream vendor (Red Hat/JBoss) in Undertow 2.1.7.Final before TuxCare onboarded this version. The fix is present in ChunkReader.java: a LIMIT constant (Long.MAX_VALUE >> 4) and an overflow check that rejects chunk sizes exceeding this limit be...", "justification": "code_not_present" } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9684fa88-3f0f-5db1-ab83-06f1146827d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1745 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-1745 affects Undertow 2.0.29.Final and before due to unrestricted acceptance of AJP request attributes. The target version 2.1.7.Final already contains the upstream vendor fix (commit e60e04f4e9bab49f406c8c57770c4a1bbbc37067 from March 2020 by Red Hat engineer Masafumi Miura). The fix filters AJP request attributes against a known-safe allowlist (ATTR_SET), rejecting unknown attributes by default unless they match an admin-configured pattern. This fix was included in upstream release 2.1.7.Final that TuxCare onboarded in October 2026. The vulnerable code pattern (unconditional acceptance of all AJP attributes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).", "justification": "code_not_present" } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f5de1288-9a74-5b4e-a579-beed498ca04c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cef3101e-8629-50cd-a7d5-8ae76cd72daa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27782 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-27782 does not affect this version. The vulnerability required malformed query strings via AJP to trigger unhandled IllegalArgumentException, causing DoS. The upstream fix (catching IllegalArgumentException in addition to ParameterLimitException during AJP query string parsing) was already present in upstream Undertow 2.1.7.Final when TuxCare onboarded this version. Both components of the fix are present: AjpRequestParser.java catches IllegalArgumentException at line 464, and AjpReadListener.java properly handles bad requests with AJP protocol responses at lines 238-266.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8cc96626-6d3d-5fed-92b7-85748710b978", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-20220 does not affect version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.1.7.Final repository is NOT AFFECTED by CVE-2021-20220. The vulnerability involves HTTP request smuggling due to permitting invalid characters in HTTP request headers (HTTP/1.x and HTTP/2). The upstream fixes were already present in Undertow 2.1.7.Final before TuxCare's onboarding. Two key patches address the issue: (1) HTTP/2 pseudo-header validation in Http2ReceiveListen...", "justification": "code_not_present" } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:16ffdb8c-6bb8-5570-97c6-31eb43eea966", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:426e0959-b8fc-55e0-87a2-a4298c712a39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:11468f95-159f-5251-b6c0-ce6c58aad9c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6be21b6d-a016-5718-8f67-fd8976f0b428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:347525cf-d697-5707-98f6-3bca59345add", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7f11bb78-b31a-577f-8e3c-156c769e26e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core, and is fixed in 2.1.7.Final-tuxcare.3." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ec9e454d-5d82-50c1-8cae-a97f91124b87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3e8c818c-d5a7-5e59-b8bf-6928b0e85e1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6bc5a87b-f2aa-535a-b5e5-af981d73c8fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f3eaa9da-4277-51fb-9745-1e8af9471135", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8b605761-6381-537a-a54b-edbb91409750", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e3eff34c-a5fd-5e85-98a0-e5f71e0795eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:69192252-f46b-51e2-b5f6-91efe89bad24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:967c9908-a8cf-5957-99c0-4ce2f773f5c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8b5d6608-d2f7-5b23-a7df-2180cb80856f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.1.7.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:66a47187-646c-5897-8bc2-400f1eeb93bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:37800091-4b3a-568b-9bc1-f1c348d5b744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6162 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e302db8c-8a76-5006-8799-9ce03c58380a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:929d8f3a-5be9-5114-9fe8-2da20dce82fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:22c9c188-4bf0-5c42-ab45-127fe69b85be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:dc741a1b-1bad-5a05-be56-302dd2984fd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2e044f18-b011-55d1-8c8a-875ce82b92e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2aefc2f6-d53a-551c-bd72-9f44569961af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:833cc4aa-94c1-5bbd-a1e0-0f49f2893e2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.1.7.Final-tuxcare.2 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.1.7.Final-tuxcare.2" } ] }