{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0737880b-62ec-5523-a28c-cadce5137e45", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2", "version": "2.3.20.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.3.20.Final", "type": "library", "group": "io.undertow", "version": "2.3.20.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1d91e758-c7a6-5a2e-905f-07e3b2e7b3d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 is NOT present in the target. The upstream vendor fix (commit 28f244e63 by Stuart Douglas) was already included in Undertow release 2.3.20.Final before TuxCare onboarding (commit 02d09c01a). The defense code that blocks backslash characters in URIs on Windows is present in all three affected files: ResourceHandler.java:202-206, DefaultServlet.java:165-177, and PathSeparatorHandler...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1901d655-53ed-5932-8f7d-e9c22ad39bad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 does not affect this target. The vulnerability pattern (BufferOverflowException from long URLs due to unbounded buffer writes) is NOT present because the upstream fix was already included in Undertow 2.3.20.Final when TuxCare onboarded it. The fix adds buffer capacity checks and incremental chunked writing to prevent overflow in HttpRequestConduit, HpackEncoder, and ProxyHandler. ...", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:675a1e35-065e-5905-83fe-905705ab9e9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.3.20.Final) is NOT affected by CVE-2017-12165. The vulnerability was fixed by upstream commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f (authored by Stuart Douglas) which was already present in the upstream 2.3.20.Final release before TuxCare onboarded it. All validation methods (verifyToken, areRequestHeadersValid, ALLOWED_TARGET_CHARACTER checks) are present a...", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0309eb6e-8425-5643-8853-f5ba73c034d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is not present in this target. The vulnerability affected Undertow's Digest authentication mechanism, which failed to validate that the URI in the Authorization header matched the actual request URI, allowing MITM attacks. The vendor's fix (commits facb33a5c and 8804170ce) was already included in the upstream Undertow 2.3.20.Final release. When TuxCare onboarded version 2.3.20.Fi...", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e6d75185-daa0-5995-81aa-3f1d95fd7cf3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 affects Undertow's HTTP request parser, which permitted invalid characters enabling HTTP request smuggling. The target repository (Undertow 2.3.20.Final-tuxcare.1) is NOT AFFECTED because the upstream vendor (Red Hat/JBoss) fixed this vulnerability in commits 1e72647 (JBEAP-9909) and 3436b03ed (UNDERTOW-1165) prior to releasing 2.3.20.Final. TuxCare onboarded the already-fixed ups...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:12949492-75cb-5a55-84e7-8bd574ba4883", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2670 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2017-2670 affects Undertow before 1.3.28 where a non-clean TCP close on WebSocket connections causes an infinite loop in IO threads. The target version 2.3.20.Final already contains the upstream fix (commit 9bfe9fbbb from June 2017) that adds STATE_STREAM_BROKEN to the loop exit condition. This fix was shipped in the upstream release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:fc7b3f70-0d1b-5ad0-b13d-1ee06a619333", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 Target version 2.3.20.Final already contains the upstream vendor's fix for CVE-2017-7559. The vulnerability required invalid characters to be accepted in query strings and path parameters; the fix added character validation to handleQueryParameters() and handlePathParameters() methods. Both fix commits (JBEAP-9909: 1e72647818c and UNDERTOW-1165: 3436b03eda8) are present in the upstream release,...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e9423cc1-38b8-5e8e-8de9-d49dfc164f1a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 file descriptor leak in URLResource.getLastModified() is NOT present in the target. The fix was already included in upstream Undertow 2.3.20.Final before TuxCare onboarded this version. The vulnerable pattern (calling connection.getLastModified() on JarURLConnection without closing file descriptors) has been replaced with safe code that retrieves modification time directly from th...", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5337d081-4c75-520d-ab1d-5aeb964ae3d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-14642 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.3.20.Final) is NOT AFFECTED by CVE-2018-14642. The vulnerability was an information leak where HttpResponseConduit.processWrite() wrote entire buffer arrays (data.length) instead of only populated portions (length + 1), potentially exposing data from previous requests. The fix (commit a83b047d5) was authored by upstream developer Stuart Douglas and was already ...", "justification": "code_not_present" } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:03725a65-4f8d-5b18-8456-5bbc73c16762", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-10212 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-10212 is not present in Undertow 2.3.20.Final. The vulnerability involved credentials being leaked in DEBUG logs through two mechanisms: (1) HttpServerExchange.toString() including request/response headers, and (2) BasicAuthenticationMechanism logging plaintext credentials. Both issues were fixed in upstream commits 20cacc96c (UNDERTOW-1515, March 2019) and 8b63e258 (UNDERTOW-1576, October 2019) which shipped in the upstream 2.3.20.Final release that TuxCare onboarded. The fixes are present in the target code at HttpServerExchange.java line 2587 and BasicAuthenticationMechanism.java lines 154-156.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:300ebf9d-9127-5c35-a210-c81792de7d95", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-14888 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-14888 affects Undertow versions before 2.0.29.Final. The target version 2.3.20.Final already contains all necessary deadlock fixes from the upstream vendor (Red Hat). The vulnerability was addressed through multiple commits (UNDERTOW-1623, UNDERTOW-1618, UNDERTOW-1624) that were included in the upstream release before TuxCare onboarded version 2.3.20.Final. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.29.Final), NVD (<= 2.0.28), cve.org (< 2.0.28.SP1), Snyk (< 2.0.29.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d9ed8d2d-3275-5330-b409-14561ded8016", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3888 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-3888 affects Undertow before version 2.0.21 due to plain text credentials being exposed in log files. The target version 2.3.20.Final already contains the upstream fixes: (1) UNDERTOW-1515 removes headers from HttpServerExchange.toString() to prevent Authorization headers from being logged, and (2) UNDERTOW-1576 removes plaintext credentials from BasicAuthenticationMechanism debug logging. Both fixes were authored by upstream Undertow developers (Carter Kozak and Paramvir Jindal) and shipped in the upstream 2.3.20.Final release prior to TuxCare onboarding (commit 02d09c01a). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:58a5fa06-e853-552c-bf96-cd0fbcfdc4bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10687 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 affects Undertow versions before 2.2.0.Final. The target (Undertow 2.3.20.Final-tuxcare.1) contains all necessary fixes for this HTTP request smuggling vulnerability. Three upstream fix commits (UNDERTOW-1165, UNDERTOW-1780, UNDERTOW-1774) adding strict character validation to HTTP/1.x and HTTP/2 parsers are present in HEAD and were shipped in the upstream 2.3.20.Final release. T...", "justification": "code_not_present" } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:683377ae-2352-5f8b-a171-ecc83a56ab15", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10705 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-10705 (UNDERTOW-1657) addresses a buffer leak vulnerability in Undertow's handling of \"Expect: 100-continue\" HTTP requests that could lead to out-of-memory errors and denial of service. The target repository at version 2.3.20.Final already contains the complete upstream fix consisting of three commits (64bbaeb7c, aa5e1fe11, b53d4589c) authored by Red Hat developers in February-April 2020. These fixes were shipped in the upstream Undertow 2.3.20.Final release that TuxCare onboarded in July 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f835f9c1-92da-5cd0-81a4-adbb61095ca7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10719 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 (HTTP request smuggling via chunk size integer overflow) is NOT present in Undertow 2.3.20.Final. The vulnerability allowed attackers to send extremely large chunk size values that would overflow during hex-to-decimal parsing, wrapping to small values and causing incorrect chunk boundary detection. The upstream fix (commit bfc8fbd67) added a LIMIT validation check before accumula...", "justification": "code_not_present" } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c89acc60-0883-5f5b-a5e7-4afe25279530", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1745 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-1745 is not present in Undertow 2.3.20.Final. The vulnerability (arbitrary AJP request attributes accepted without validation, enabling file inclusion attacks) was fixed in upstream commit e60e04f4e (UNDERTOW-1667) which shipped in Undertow 2.0.30.Final. Version 2.3.20.Final, released much later, includes this fix. The target contains the complete mitigation: unknown AJP attributes are validated against an allowlist (ATTR_SET) and only accepted if they match a configured pattern; unknown attributes are silently rejected by default. The fix was authored by Red Hat (mmiura@redhat.com) and included in the upstream 2.3.20.Final release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).", "justification": "code_not_present" } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:db524bdd-4b66-57f3-b2c5-f611ee1f6ec3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2575e062-71ff-569c-9604-00537a552078", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27782 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. Target repository version 2.3.20.Final is not affected by CVE-2020-27782. The vulnerability in the AJP connector that allowed malicious query strings with non-RFC compliant characters to cause denial of service has been fixed in the upstream release. Both required patches (UNDERTOW-1404 and UNDERTOW-1824) are present in the codebase and were included in the upstream 2.3.20.Final release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a710d28c-df30-5be8-b3d8-119dccbae3f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-20220 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.3.20.Final-tuxcare.1) is NOT AFFECTED by CVE-2021-20220. All required fixes for this HTTP request smuggling vulnerability were already present in the upstream 2.3.20.Final release that TuxCare onboarded. The fixes include: (1) HTTP/2 pseudo-header validation for :path, :scheme, :authority, and :method headers to reject invalid characters (UNDERTOW-1780), and (2...", "justification": "code_not_present" } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4f33aa0e-8cf4-5e08-a54f-114d10b7bcb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3597 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 (UNDERTOW-1842) describes a denial of service where HTTP2SourceChannel fails to write the final frame under certain conditions. The upstream fix (commit b929047) was already included in Undertow version 2.3.20.Final before TuxCare onboarded this version. The vulnerable pattern does not exist in the target code because the fix is present at AbstractFramedStreamSinkChannel.flushComp...", "justification": "code_not_present" } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:01f3798f-fca9-5cb2-82de-f1c597dc071c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3629 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target (Undertow 2.3.20.Final) is not affected by CVE-2021-3629. The vulnerability affects versions prior to 2.0.40.Final and prior to 2.2.11.Final. Version 2.3.20.Final is newer and already contains the upstream fix from UNDERTOW-1910 (commit a4e7b1dbd), which was shipped in the upstream release before TuxCare onboarding. The fix changes AbstractFramedStreamSinkChannel.awaitWritable() from...", "justification": "code_not_present" } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4e1eb9d4-00b9-5c87-a54c-777463e45356", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3690 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2021-3690 (buffer leak on WebSocket PONG messages) is NOT present in this version. The fix was already included in the upstream release 2.3.20.Final that TuxCare onboarded. The vulnerable code pattern (missing buffer.free() call in the else branch of onFullPongMessage) has been remediated by upstream commit c7e84a0b7e authored by Andrey Marinchuk, which added the necessary buffer cleanup at FrameHandler.java:155-156.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6d06897d-c218-5ab5-af14-ddf70936c853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3859 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2021-3859 describes a vulnerability in Undertow's HTTP/2 implementation where continuation frames are not read correctly, allowing DoS attacks via client-side invocation timeouts. The target version 2.3.20.Final is not affected because the upstream fix (commit e43f0ada3f4da6e8579e0020cec3cb1a81e487c2 by rmartinc@redhat.com) was already present in the upstream release when TuxCare onboarded this version. Both Http2Channel.java and HpackEncoder.java contain the fixed code that properly handles continuation frames. The CVE affects versions < 2.2.15.Final, and 2.3.20.Final is well above that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0b607902-35f5-52e2-a4a4-d1303a99c830", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-2053 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.3.20.Final-tuxcare.1) is NOT vulnerable to CVE-2022-2053. The fix for this AJP DoS vulnerability was already present in the upstream Undertow 2.3.20.Final release that TuxCare onboarded. The vulnerable exception handling pattern (catching RequestTooBigException with general exceptions and immediately closing the connection without response) has been replaced with proper handling that allows RequestTooBigException to propagate up the call stack for appropriate error response, preventing proxies from marking backend workers as failed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2).", "justification": "code_not_present" } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:faf4fce5-5e93-5012-9800-2ca59b80bccf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-4492 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2022-4492 is not present in Undertow 2.3.20.Final. The vulnerability (missing HTTPS endpoint identity verification in SSL/TLS client connections) was fixed by upstream Red Hat in commit e5071e52b before the 2.3.20.Final release. TuxCare onboarded this already-fixed version. The defense code (setting ENDPOINT_IDENTIFICATION_ALGORITHM to \"HTTPS\" by default) is present in HttpClientProvider.java, Http2ClientProvider.java, and UndertowXnioSsl.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cf5e7f0f-37d0-5bfc-92e1-4563e66d3f35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-1108 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2023-1108 is NOT present in the target. The vulnerability (infinite loop in SslConduit.wrapAndFlip when SSL handshake status NEED_WRAP persists while engine inbound is done) was fixed by upstream commit ccc053b55 authored by frainone@redhat.com on 2023-02-28. This fix was already included in upstream release 2.3.20.Final when TuxCare onboarded it on 2026-07-14 via commit 02d09c01a. The fix adds `!engine.isInboundDone()` check to the wrap loop condition at line 1011 of SslConduit.java, preventing the infinite loop that would cause denial of service.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7ef33d5e-b5e0-541c-90f9-5db1b4900746", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-1973 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.3.20.Final) is NOT affected by CVE-2023-1973. The vulnerability pattern has been removed by an upstream fix that was already included in the 2.3.20.Final release before TuxCare onboarded it. The fix limits session timeout to 2 minutes for sessions created during form authentication, preventing memory exhaustion attacks via accumulation of long-lived unauthenticated sessions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final), Snyk (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:542b0395-c9df-5bef-a21d-c2651f3b89d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-4639 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. Target version 2.3.20.Final is not affected by CVE-2023-4639. The cookie parsing vulnerability was fixed by upstream commit 1f93a979d (authored by baranowb@gmail.com), which was already included in the upstream 2.3.20.Final release that TuxCare onboarded. The fix adds defensive code at Cookies.java:321-324 that abandons malformed cookies when a delimiter (semicolon or comma) is encountered inside a quoted value before the closing quote, preventing subsequent legitimate cookies from being consumed or ignored.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.11.Final; < 2.2.30.Final), Snyk (< 2.2.30.Final; >= 2.3.0.Alpha1, < 2.3.11.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0cc63cdc-6ff0-50e2-9edd-5f4996fcd842", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1459 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2024-1459 path traversal vulnerability is not present in this target. The upstream fix (commit 9b7c5037e by Tomas Hofman/Flavia Rainone @redhat.com) was already included in Undertow 2.3.20.Final when TuxCare onboarded this version. The fix modifies HttpRequestParser.handlePath() to preserve semicolons in the canonical path when inside dot-segments (\".\" or \"..\"), preventing the malicious seq...", "justification": "code_not_present" } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c5d61e2d-2da9-57c3-97df-989170d20073", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1635 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.3.20.Final) is NOT AFFECTED by CVE-2024-1635. The vulnerability (memory/file descriptor exhaustion through leaked WriteTimeoutStreamSinkConduit timeout task references when connections close unexpectedly) has already been fixed in the upstream 2.3.20.Final release. The fix commit (e3bcd5b47, dated 2024-01-08 by Flavia Rainone ) was present in the upstream release before TuxCare onboarded it (onboarding commit 02d09c01a, dated 2026-07-14). All defensive mechanisms are present: volatile handle field, close listener in constructor, synchronized handle removal operations, and try-finally cleanup blocks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Final, < 2.3.12.Final; < 2.2.31.Final), cve.org (= 1.31.0), Snyk (< 2.2.31.Final; >= 2.3.0.Final, < 2.3.12.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1ca1afcb-626c-59ab-a29f-bef991cc4e25", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-3653 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.3.20.Final) is NOT AFFECTED by CVE-2024-3653. The vulnerability concerns unbounded cache growth in the LearningPushHandler when maxAge is configured to -1 (no expiry), allowing attackers to exhaust memory via HTTP requests with various Referer headers. However, the upstream 2.3.20.Final release already includes the fix commits (a03e5189b and 6b8e79c16) that add...", "justification": "code_not_present" } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8b277a8a-3a56-5259-9c56-dc6e8e81642a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0bbe3ac4-25a5-5e68-b045-489255a44de0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:057ef80b-f01a-554d-88a5-a12f97c0decc", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.3.20.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:66b88ab2-8c2b-534a-b782-907e96999b95", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-5971 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2024-5971 affects Undertow's chunked response handling over TLS 1.3 (Java 17), where incorrect SSL byte accounting prevented the server from sending the `0\\r\\n` chunk terminator. The target repository at version 2.3.20.Final already contains the upstream fix (commit 1418733c9 by Flavia Rainone from Red Hat, May 2024). This fix was shipped in the upstream Undertow 2.3.20.Final release before TuxCare onboarded it (July 2026). The vulnerable code pattern is not present because the upstream vendor resolved it prior to TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.15.Final; < 2.2.34.Final), cve.org (< 2.2.34.Final; >= 2.3.0.Alpha1, < 2.3.15.Final), Snyk (< 2.2.34.Final; >= 2.3.0.Final, < 2.3.8.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4ebbd08c-6bf3-514e-bebc-b41d8fe7e626", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6162 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.3.20.Final-tuxcare.1) is NOT AFFECTED by CVE-2024-6162. The vulnerability pattern (shared StringBuilder buffer in AjpRequestParser causing path confusion between concurrent requests) is not present in the target code. The upstream fix commit 90f202ada by Tomas Hofman (thofman@redhat.com) was already included in the upstream 2.3.20.Final release that TuxCare onboarded, prior to any TuxCare modifications. The fix creates a new local StringBuilder for each decode operation instead of reusing a shared instance field, preventing path data contamination between requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.14.Final; < 2.2.33.Final), cve.org (< 2.2.33.Final; >= 2.3.0.Alpha1, < 2.3.14), Snyk (< 2.2.33.Final; >= 2.3.0.Final, < 2.3.14.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4126ba57-51ec-59a2-a3a0-272e8c83adb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-7885 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. The upstream fix was released in 2.3.17.Final, and version 2.3.20.Final is a later release of the same line. Advisories: GitHub GHSA-9623-mqmm-5rcf (fixed in 2.3.17.Final), CVE record (fixed in 2.3.17.Final), Snyk (fixed in 2.3.17.Final).", "justification": "code_not_present" } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c8ef13f0-daaa-5c04-a448-11f9e033935b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core, and is fixed in 2.3.20.Final-tuxcare.3." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a8b9ab3c-aeec-539a-b193-30520340c7a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-9784 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. Target version 2.3.20.Final already contains the complete upstream fix for CVE-2025-9784 (MadeYouReset attack). The defense mechanism tracking server-sent RST_STREAM frames was committed by Red Hat upstream (frainone@redhat.com) in September-October 2025 and shipped in the upstream 2.3.20.Final release before TuxCare onboarded it in July 2026. All four fix commits are present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.38.Final; >= 2.3.0.Alpha1, < 2.3.20.Final), cve.org (< 2.2.38.Final), Snyk (< 2.2.38.Final; >= 2.3.0.Alpha1, < 2.3.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:64c0df1a-0cf6-5952-8b59-40cece9a80c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:feb221bc-6107-5610-83ba-cf1dbf21c716", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-28368 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. already_fixed \u2014 The target repository (Undertow 2.3.20.Final) already contains all defensive mechanisms required to prevent CVE-2026-28368 request smuggling attacks. The defenses were introduced through earlier backports (JBEAP-9909, UNDERTOW-1165, UNDERTOW-1774) and are functionally equivalent to the 2025 CVE patches, which primarily performed an architectural rewrite rather than introducing new security cont...", "justification": "code_not_present" } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ea4ff4fc-743d-5dc4-b477-87869ca36e50", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-28369 does not affect version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core. Patches already applied: 80b34f852a3fb8fc39309773cc739d05187381d8 (already in target via 3dea400a8c62 '[JBEAP-18580][UNDERTOW-1774] Treat whitespace as illegal in header field-name')", "justification": "code_not_present" } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:dda8fc70-5213-534d-a352-0a3c6064735c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.3.20.Final-tuxcare.2 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.20.Final-tuxcare.2" } ] }