{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6adf69b2-f088-5586-80bf-e9db4d29627c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2", "version": "2.2.7.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.2.7.Final", "type": "library", "group": "io.undertow", "version": "2.2.7.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:accc5a78-4383-57dd-8c04-4f909bfca11e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 (UNDERTOW-338) directory traversal vulnerability is NOT present in Undertow 2.2.7.Final. The upstream fix (commit 28f244e63) was already included in the 2.2.7.Final release that TuxCare onboarded. The fix rejects HTTP requests whose resource paths contain backslashes on Windows systems, preventing path separator confusion attacks. All three critical resource-serving code paths (Re...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:fb8b12b8-e262-584e-9f3e-060a456200d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 (UNDERTOW-835): The vulnerability allowing BufferOverflowException from long URLs was fixed in upstream Undertow prior to version 2.2.7.Final. The fix was already present when TuxCare onboarded this version, so no backport was needed. All three components of the fix are present: (1) HttpRequestConduit checks request line length and uses incremental STATE_URL writing for long URLs,...", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4fcba4b9-eb86-58f7-88aa-27c51ee7124f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12165 is NOT present in Undertow 2.2.7.Final. The vulnerability relates to HTTP request smuggling through improper handling of unusual whitespace and invalid characters in HTTP headers, methods, and URIs. The upstream fix (commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f, authored by Stuart Douglas) was already included in the 2.2.7.Final release when TuxCare onboarded it on 2026-09-07....", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:872e415f-ab0a-5614-bb5b-a20b3c60ad59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.2.7.Final) is NOT AFFECTED by CVE-2017-12196. The vulnerability involved missing URI validation in Digest authentication, allowing attackers to reuse authentication credentials for different URIs. The fix was committed upstream by Stuart Douglas in commits facb33a5c and 8804170ce (UNDERTOW-1190), which added mandatory URI validation to DigestAuthenticationMecha...", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:539db578-668e-5690-a901-cced1a5873da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 Target repository Undertow 2.2.7.Final is NOT affected by CVE-2017-2666 (HTTP request smuggling via invalid characters). The upstream vendor fix was already included in the 2.2.7.Final release (March 2021) before TuxCare onboarding. All three defense mechanisms from the vendor patches are present: (1) RFC 7230 token validation for methods/headers, (2) target character validation rejecting contr...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bfa5fa6a-e61c-506d-9f0a-dfc525781c6f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2670 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2017-2670 is not present in target version 2.2.7.Final. The vulnerability (infinite loop on IO threads caused by non-clean WebSocket TCP close) was fixed upstream in commit 9bfe9fbbb by adding STATE_STREAM_BROKEN check to the listener loop exit condition. This fix was already included in the upstream 2.2.7.Final release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (0482ba722 \"Onboard version 2.2.7.Final\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:efa07014-2df4-513f-a838-5d7c2c8ccdcf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 affects Undertow versions before 2.0.0.Alpha2 (2.x), 1.4.17.Final (1.4.x), and 1.3.31.Final (1.3.x). The vulnerability involves invalid characters (control characters like CR, LF) being allowed in query strings and path parameters, enabling HTTP response splitting attacks. The target version 2.2.7.Final is well after the fixed version (2.0.0.Alpha2) and contains the complete fix: ...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:db9f26ba-2dfe-566a-9b56-d35aad75f145", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 is not present in target version 2.2.7.Final. The vulnerability involved URLResource.getLastModified() leaking file descriptors when handling JAR files because it called connection.getLastModified() on JarURLConnection objects, which held file descriptors until garbage collection. The upstream fix (commit 882d5884f) was already included in Undertow 2.2.7.Final when TuxCare onboard...", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:15bd9dea-c73e-5b9a-90ed-2a951bb51a7f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-14642 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 (UNDERTOW-1412) is NOT present in this target. The vulnerability was an information disclosure issue where HttpResponseConduit.processWrite() would write the entire writevBuffer array capacity (data.length) instead of only the populated slots, potentially leaking stale buffer data from previous requests. The fix (commit a83b047d5 by Stuart Douglas) changed the write operations to...", "justification": "code_not_present" } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b7a9cf7e-8064-5bcc-b5da-302a5ff435ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-10212 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. The target (Undertow 2.2.7.Final at SHA f5e23b4809126d219e99fb3deaa925c2e910be9f) is not affected by CVE-2019-10212. The vulnerability involved logging user credentials in plain text through DEBUG logs in io.undertow.security. Both necessary fixes (UNDERTOW-1515 removing headers from HttpServerExchange.toString() and UNDERTOW-1576 removing plaintext credentials from BasicAuthenticationMechanism debug logs) were already present in the upstream 2.2.7.Final release before TuxCare onboarding (commit 0482ba722). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8800d9cf-47a3-54ff-b4ba-51fc9c912103", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6e2a283b-5e79-5140-a0c2-42ebe4f399ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3888 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-3888 affects Undertow versions before 2.0.21. The target version 2.2.7.Final contains upstream fixes that prevent credential exposure through logs. HttpServerExchange.toString() no longer includes request/response headers (commit 20cacc96c), and BasicAuthenticationMechanism no longer logs decoded credentials (commit 8b63e2585). Both fixes were authored by upstream developers and shipped in the 2.2.7.Final release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b63674d2-ba99-53ff-a9e4-f1f1c58ab4d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10687 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 affects Undertow versions before 2.2.0.Final, allowing HTTP request smuggling through invalid characters in HTTP requests. The target repository is Undertow 2.2.7.Final, released in March 2021, which already contains all three upstream security patches: UNDERTOW-1165 (HTTP/1.x validation, 2017), UNDERTOW-1774 (header field-name whitespace rejection, Feb 2020), and UNDERTOW-1780 (...", "justification": "code_not_present" } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:931da5e3-795b-5fee-b80c-375d3e55bae3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10705 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-10705 affects Undertow versions before 2.1.1.Final. The target is version 2.2.7.Final, which already includes the UNDERTOW-1657 fix in the upstream release. All defense mechanisms from the vendor patches are present: ResponseCommitListener that terminates request channels when continue response is not sent, buffer cleanup via freeContinueResponse(), proper handling of EXPECTATION_FAILED status (417), and connection marked as non-persistent to prevent buffer leaks. The fix was authored by upstream Red Hat developers (frainone@redhat.com, stuart.w.douglas@gmail.com) and shipped in 2.1.1.Final, well before the 2.2.7.Final release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d7b24a66-50d7-5cf1-bf82-b211c4fa7d25", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10719 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 is not present in this target. The vulnerability concerns integer overflow in HTTP chunked transfer encoding chunk size parsing, which could enable request smuggling. The fix (LIMIT check preventing overflow) was already included in the upstream Undertow 2.2.7.Final release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6333d3f6-d4d7-5215-a2a1-fb222113dc96", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1745 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-1745 is NOT present in Undertow 2.2.7.Final. The vulnerability (arbitrary AJP request attributes blindly stored, enabling file inclusion attacks) was fixed in upstream commit e60e04f4e by Red Hat on 2020-02-27. This fix shipped in the upstream 2.2.7.Final release that TuxCare onboarded. The target contains the complete fix: unknown AJP attributes are now rejected by default unless they match a known-safe list (ATTR_SET) or an optional admin-configured whitelist pattern. The vulnerable code pattern (state.attributes.put(state.currentAttribute, result) without validation) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).", "justification": "code_not_present" } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:908d190a-d646-5f34-abd8-1f6ff9b9efe8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:48daaa51-cd1a-5d58-821f-a171337bcd15", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27782 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-27782 affects Undertow's AJP connector where malformed query strings with non-RFC compliant characters could cause denial of service. The target version 2.2.7.Final already contains both upstream fixes (UNDERTOW-1404 and UNDERTOW-1824) that were shipped in the original 2.2.7.Final release. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:21eec0f4-0b7d-5e35-b274-f546bab269e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-20220 does not affect version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-20220 affects Undertow due to permitting invalid characters in HTTP request headers, enabling request smuggling. The target repository version 2.2.7.Final already contains both required fixes: (1) HTTP/2 pseudo-header character validation in Http2ReceiveListener.checkRequestHeaders() validating PATH, SCHEME, AUTHORITY, and METHOD headers, and (2) HTTP/1.x whitespace rejection in header...", "justification": "code_not_present" } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6f287ee5-811e-5fce-8b44-615a31828ab5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:370bb382-9b3b-50e0-8d59-982514df2441", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a824691d-f712-5730-a105-11155a56ef1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:69a6fd17-8494-5cd4-bc38-0a41068b86e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e0c713b5-5b75-5ea7-b88b-391459c8fd57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:696084fb-081b-5b88-8a0c-d99c11ff266e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1319 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2d09b0b8-4325-54ad-b2af-5050950d6fdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-2764", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b2f97820-8df3-5e9e-a003-f1c8d8ce45b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2764 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9379d7da-4930-5cc9-a4e9-235961724cbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core, and is fixed in 2.2.7.Final-tuxcare.3." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:177f48fc-8ddb-510d-9122-aa66725e702f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d685c543-1818-5cc1-8505-e76bdee4eb87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:374dbfbc-4325-5ce4-bed3-e40f2c8a0039", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:28fdd771-ad41-54ec-928a-20245311f3e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a62fcba2-b4dc-57da-957d-af5dcc6fc706", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e8703659-9dae-5527-a7b7-94f7e21dcfc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:da8a44f8-9e03-51b0-94ab-421f97ae540b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9e2c911f-90c2-571d-8cc8-4708f34a943f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4f3770f1-0643-5bae-b42e-543f8c94d8d6", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.2.7.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2c9da84a-0313-5b07-b23e-3033534f7d83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3cfb020f-b983-5384-adc0-6e096f000c4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6162 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4f6d60b1-a2ee-5452-87de-f40250aaebaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:76fe0c8d-99ec-5560-99b3-27d930591315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:68b13b00-565b-5f6b-a942-414653ed471e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c107981d-e811-56e9-b305-1fd5fb9d9c97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:44d50811-1dd1-53d9-b550-abc052ee5715", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:034d25a0-a318-5473-9125-c5c3c6b4c521", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5713969c-babd-50c9-881a-9133b51b88ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.2.7.Final-tuxcare.2 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.7.Final-tuxcare.2" } ] }