{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d0667c18-1967-57c6-ba0f-1fcc654a886c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8", "version": "2.3.10.Final-tuxcare.8", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.3.10.Final", "type": "library", "group": "io.undertow", "version": "2.3.10.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:8d3cb3d3-c0d7-51df-805d-b94b7c65c48a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 Target version 2.3.10.Final is NOT AFFECTED by CVE-2014-7816. The vulnerability (directory traversal via backslash characters on Windows) was fixed by upstream commit 28f244e63 authored by Stuart Douglas, which shipped in the upstream release before TuxCare onboarding. All defensive code is present: PathSeparatorHandler normalizes backslashes, and ResourceHandler/DefaultServlet/ServletPathMatch...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:fdd9c9c9-8ba9-58ec-a003-363a6bc5d63b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 (UNDERTOW-835) is not present in the target. The fix for BufferOverflowException when processing long URLs in proxy requests was already included in upstream Undertow 2.3.10.Final before TuxCare onboarded it. Fix commit c518b5a17 (authored by Stuart Douglas, upstream developer, on 2016-09-15) added buffer size checking and incremental writing for long URLs in HttpRequestConduit an...", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:09b29c31-f924-5617-a30b-7bf8352a4466", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.3.10.Final-tuxcare.8 is NOT vulnerable to CVE-2017-12165. The upstream vendor (Stuart Douglas) fixed this HTTP request smuggling vulnerability in commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f (JBEAP-9909, March 2017), which shipped in the upstream 2.3.10.Final release. The fix adds comprehensive validation: (1) RFC 7230 token character validation for HTTP headers and met...", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:4db81d8a-985a-5360-95ef-d29fc5e0157e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 does not affect Undertow 2.3.10.Final. The vulnerability (missing URI validation in Digest authentication allowing MITM attacks) was fixed in upstream commits facb33a5 and 8804170c (Oct-Dec 2017). These fixes were already present in upstream version 2.3.10.Final when TuxCare onboarded it. The target contains the complete URI validation logic at DigestAuthenticationMechanism.java:...", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:e52cfdfb-2b76-5c77-a637-5cd42b221ec9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.3.10.Final-tuxcare.8 is not affected by CVE-2017-2666. The vulnerability fixes were already present in the upstream Undertow 2.3.10.Final release that TuxCare onboarded. The fixes include: (1) ALLOWED_TARGET_CHARACTER validation in HttpRequestParser to reject invalid characters in request paths, query parameters, and path parameters; (2) verifyToken() method in Connectors ...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:aa1e5d1f-c159-514a-9843-d0c6c6b7c7e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2670 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2017-2670 is not present in Undertow 2.3.10.Final. The upstream fix (commit 9bfe9fbbb) that adds STATE_STREAM_BROKEN check to prevent infinite loop on non-clean TCP close was already included in the upstream release before TuxCare onboarding. The vulnerable pattern where the read listener loop could iterate infinitely is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:d3e6064c-70a8-52ba-bdd4-db42585a1188", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 affects Undertow versions before 2.0.0.Alpha2 (incomplete fix for CVE-2017-2666 allowing invalid characters in query strings and path parameters). The target version 2.3.10.Final-tuxcare.8 is NOT affected because the upstream fix (commit 1e72647818c by Stuart Douglas, March 2017) was already included in the release. The fix implements comprehensive character validation via ALLOWED...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:ac4cddc8-600e-5de8-b3d0-b100fb829bdf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 is NOT present in this target. The vulnerability involved a file descriptor leak in URLResource.getLastModified() when handling JAR URLs - JarURLConnection.getLastModified() opened file descriptors that were only closed on finalization. The upstream fix (commit 882d5884f by Norito Agetsuma, April 2018) was already included in Undertow 2.3.10.Final when TuxCare onboarded it. The fi...", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:cb438677-4809-59c1-976b-9ad64cd77abb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-14642 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 (information leak via uninitialized buffer in HTTP response) is NOT present in the target repository. The vulnerable code pattern was fixed by upstream Undertow developer Stuart Douglas in commit a83b047d5 (UNDERTOW-1412) on 2018-09-13. This fix was already included in the upstream 2.3.10.Final release (2023-10-17), which TuxCare subsequently onboarded. The target's HttpResponseC...", "justification": "code_not_present" } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:6a94d1c4-f034-5385-b160-a7e1fef546d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-10212 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2019-10212 is NOT PRESENT in the target. The vulnerability (credentials logged at DEBUG level) was fixed by upstream commits UNDERTOW-1576 and UNDERTOW-1515, both of which shipped in the upstream release 2.3.10.Final that TuxCare onboarded. The fixes remove plainChallenge/base64Challenge from debug logs in BasicAuthenticationMechanism and remove headers from HttpServerExchange.toString(), preventing credential leakage through log files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:04718bae-3eb9-589c-a6d1-c2be645f63ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-14888 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2019-14888 describes a deadlock vulnerability in Undertow's HTTPS/SSL handling that allows denial of service attacks. The target repository (Undertow 2.3.10.Final) is NOT AFFECTED because comprehensive upstream fixes were already included in version 2.3.10.Final (released October 17, 2023) before TuxCare onboarded it. The fixes address deadlock conditions by restructuring synchronization in the framed channel implementation - moving critical method calls (queueFrame, queueFinalFrame) outside synchronized blocks, preventing race conditions in wakeupReads(), and fixing false-positive loop detection. All fixes were authored by upstream developers (Red Hat) and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.29.Final), NVD (<= 2.0.28), cve.org (< 2.0.28.SP1), Snyk (< 2.0.29.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:f751d548-a76a-5873-9bc0-8c3e39c289ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3888 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2019-3888 is NOT present in this target. The vulnerability involved logging plain text credentials through HttpServerExchange.toString() at ERROR level. The upstream fixes (UNDERTOW-1515 and UNDERTOW-1576) were already present in version 2.3.10.Final before TuxCare's onboarding. The current code shows HttpServerExchange.toString() returns only method and URI without headers (line 2596), and BasicAuthenticationMechanism debug logs omit credential values (lines 154, 156). Both fix commits (20cacc96c, 8b63e2585) are ancestors of HEAD and predate the first TuxCare commit (91a89848, dated 2025-12-11) by over 5 years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:4cc823d4-b5a2-5dcb-91c6-4877d58b2392", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10687 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 addresses HTTP request smuggling via invalid characters in HTTP/1.x and HTTP/2. The target version 2.3.10.Final contains all three fix components: (1) HTTP/1.x character validation in paths/queries (ALLOWED_TARGET_CHARACTER checks), (2) HTTP/2 pseudo-header validation (:path, :scheme, :authority, :method), and (3) whitespace rejection in header field-names. All fixes were authore...", "justification": "code_not_present" } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:bcb950a1-3b93-582e-a99b-a729accc6d1a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10705 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. The target Undertow 2.3.10.Final is not affected by CVE-2020-10705. The complete fix for the HTTP 100-continue buffer leak vulnerability was already present in the upstream 2.3.10.Final release. All three upstream fix commits (64bbaeb7c, aa5e1fe11, b53d4589c) authored by Red Hat developers in Feb-Apr 2020 were included in the release that TuxCare later onboarded. The vulnerable buffer leak pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:393238e5-7df9-5fe9-a7c0-5af3db68c84e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10719 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 is not present in this target. The vulnerability involved unbounded chunk size parsing in HTTP chunked transfer encoding, allowing integer overflow that could enable request smuggling. The upstream Undertow project fixed this in commit bfc8fbd67 (Feb 2020) by adding a bounds check (LIMIT = Long.MAX_VALUE >> 4) before bit-shifting the chunk size accumulator. This fix was already p...", "justification": "code_not_present" } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:17ae23ee-fbf1-5059-8cfe-2a829ea746fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1745 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2020-1745 is not present in the target. The vulnerability allowed arbitrary AJP request attributes to bypass validation, enabling file inclusion attacks. The fix (UNDERTOW-1667) was introduced in upstream Undertow 2.0.30.Final by Red Hat engineer Masafumi Miura on 2020-02-27. The target version 2.3.10.Final-tuxcare.8 is based on a later upstream release that already contains the fix. The vulnerable code pattern (unconditionally accepting unknown attributes) is not present; instead, unknown attributes are validated against a whitelist (ATTR_SET) or an optional regex pattern, with unmatched attributes silently dropped.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).", "justification": "code_not_present" } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:3188cd3c-42c5-5cb5-b869-ec2a1535b2fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:8606989a-9690-5853-b717-94ab1e54c372", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27782 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2020-27782 affects Undertow's AJP connector when handling query strings with non-RFC compliant characters (e.g., malformed percent-encoding like \"param=value%http\"). The target repository version 2.3.10.Final is NOT vulnerable. Both required fixes were already present in the upstream 2.3.10.Final release that TuxCare onboarded: (1) UNDERTOW-1404 (commit a51659679) catches IllegalArgumentException during query string parsing to prevent unhandled exceptions, and (2) UNDERTOW-1824 + UNDERTOW-2060 (commits fdac349cb + eefae2878) ensure proper error responses via endExchange() to prevent abrupt connection closes. All fixes were authored by upstream Red Hat engineers (thofman@redhat.com, opalka.richard@gmail.com, aogburn@redhat.com) and committed before TuxCare's first commit (91a898489). The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:bbc4deb1-3e53-5ac0-9ec3-3a351d1bee4c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-20220 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-20220 is not present in Undertow 2.3.10.Final-tuxcare.8. The vulnerability involves HTTP request smuggling via invalid characters in HTTP request headers. The fix (commit cb6cdc4e0) adds strict character validation for HTTP/2 pseudo-headers (PATH, SCHEME, AUTHORITY, METHOD) and was already present in upstream release 2.3.10.Final (Oct 2023) before TuxCare onboarded it. Both HTTP/1.x an...", "justification": "code_not_present" } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:97878481-ba2b-52cb-9fd9-61e697c3e2bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3597 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 is not present in Undertow 2.3.10.Final-tuxcare.8. The vulnerability was fixed in the upstream release 2.3.10.Final (October 2023) via commit b92904715 authored by Flavia Rainone (Red Hat), well before TuxCare onboarded this version (December 2025). The fix ensures that the final HTTP/2 frame is properly requeued when there are remaining bytes in the header buffer, preventing the ...", "justification": "code_not_present" } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:9a70312f-3c2f-51c2-835a-3d385ee4c6e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3629 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3629 affects Undertow versions prior to 2.0.40.Final and 2.2.11.Final. The target version 2.3.10.Final-tuxcare.8 is not affected because the upstream fix (UNDERTOW-1910 and subsequent refinements) was already present in the upstream 2.3.10.Final release that TuxCare onboarded. The fix prevents indefinite thread blocking during HTTP/2 flow control exhaustion by adding bounded timeouts t...", "justification": "code_not_present" } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:394c1128-0a26-5fe1-8834-6431733537d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3690 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2021-3690 (WebSocket PONG buffer leak) is not present in the target Undertow 2.3.10.Final-tuxcare.8. The upstream fix (commit c7e84a0b7) was already included in the base release before TuxCare onboarding. The fix adds an else block in FrameHandler.onFullPongMessage() that explicitly frees the buffer data when no PONG handler is registered, preventing memory exhaustion through buffer accumulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:1e4e65ce-b8ff-5b32-ac66-ff6ebe92b4a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3859 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2021-3859 affects Undertow versions before 2.2.15.Final due to improper handling of HTTP/2 CONTINUATION frames, causing timeouts and DoS. The target version 2.3.10.Final-tuxcare.8 already contains the upstream fix (commit e43f0ada3) that was released in Undertow 2.2.15.Final in February 2022, well before TuxCare onboarded this version in December 2025. Both code changes are verified present: Http2Channel.parseFrame() uses a do-while loop to consume continuation frames immediately, and HpackEncoder advances the header iterator correctly when resuming from overflow. This is an upstream fix authored by Red Hat (rmartinc@redhat.com), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:03fcb8ef-5069-5d33-97f5-d6beaa770bcb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-2053 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2022-2053: Target is NOT AFFECTED. The vulnerability pattern (AjpServerRequestConduit closing connection without sending response when POST request exceeds maxEntitySize) is not present in the target. The fix was already included in upstream Undertow 2.3.10.Final, which TuxCare onboarded. The code at core/src/main/java/io/undertow/server/protocol/ajp/AjpServerRequestConduit.java:206-207 contains the fix: RequestTooBigException is caught and re-thrown WITHOUT closing the connection, allowing proper error response handling upstream. Fix commit 2825b026d by Jason Lee (upstream) is an ancestor of the first TuxCare onboarding commit 91a89848.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2).", "justification": "code_not_present" } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:750ac6df-2836-5759-aad3-6dcf5e564eac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-4492 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2022-4492 is NOT present in undertow 2.3.10.Final-tuxcare.8. The vulnerability (missing hostname verification in HTTPS/HTTP2 client connections) was fixed by upstream vendor RedHat in commit e5071e52b, which was already included in the upstream release 2.3.10.Final that TuxCare onboarded. The fix sets ENDPOINT_IDENTIFICATION_ALGORITHM to \"HTTPS\" by default in HttpClientProvider and Http2ClientProvider, enabling Java's built-in TLS hostname verification to prevent man-in-the-middle attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:c06de45a-7277-53db-801e-5b7676763f45", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-1108 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core. CVE-2023-1108 is not present in undertow 2.3.10.Final-tuxcare.8. The vulnerability (infinite loop in SslConduit.wrapAndFlip when engine.isInboundDone() is true but handshake status is NEED_WRAP) was fixed by upstream commit ccc053b55 authored by Red Hat, which shipped in the upstream 2.3.10.Final release before TuxCare onboarded it. The fix adds a check '!engine.isInboundDone()' to the loop condition at line 1009, preventing the infinite loop that causes denial of service.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:5167a30f-84a0-5034-aecb-5d66b503f4a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:a32fd13a-2058-5d60-81c0-7ab6d6a5487b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:d6bf2acf-7847-5c97-a25d-442b505e0c11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:5f572742-675d-5974-8b9c-bace4a92bd94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:19e48e7e-9c12-5caa-9d7f-7f7ab095ceb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:74480291-b127-58d4-9c09-703c58d72145", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3884 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:e0d0dcba-4e42-5dd1-8023-8cbcb742ce8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:50b34f1b-8e54-537e-b3c8-382ddc626527", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.3.10.Final-tuxcare.8." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:fa87c5c4-4a5d-5f61-a216-3ffaccf9d9ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:1931f6b6-9a46-5f29-aab2-947d416ce861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6162 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:0d032e4c-b6b2-52b0-8a09-7fe84f476359", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:18576c71-8cc4-59a5-8ccd-ff9ca67c1d2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:70fe2b46-6226-5fe3-9524-cf45f015a000", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:18501271-59d0-5f0e-bd66-7259708b1228", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:ba088f4d-dac0-58ae-a6d3-141c71d08d88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:0eb9bef8-bfba-5252-b8fa-5c6b3d61c590", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ], "bom-ref": "urn:uuid:d7bda95f-06dd-59ec-8f92-6ee287113440", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.10.Final-tuxcare.8" } ] }