{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:858e865e-2796-586a-8793-34af040584d7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1", "version": "2.3.24.Final-tuxcare.1", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.3.24.Final", "type": "library", "group": "io.undertow", "version": "2.3.24.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:040577d4-9fa5-526c-b9c0-d948ff0c93bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 The target (Undertow 2.3.24.Final-tuxcare.1) is NOT vulnerable to CVE-2014-7816. The directory traversal vulnerability affecting Windows systems was fixed by upstream commit 28f244e63 (UNDERTOW-338) authored by Stuart Douglas, which shipped with Undertow 2.3.24.Final before TuxCare onboarded the release. The fix prevents attackers from using backslash characters in URIs to bypass path canonical...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:76d7c73e-2300-5678-8a1a-f28294eab8d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 is not present in Undertow 2.3.24.Final. The vulnerability (BufferOverflowException from long URLs) was fixed by Stuart Douglas in September 2016 (commit c518b5a1) and included in all releases since 1.3.25.Final/1.4.3.Final/2.0.0.Beta1. The fix was already present in the upstream 2.3.24.Final release that TuxCare onboarded. All three fix components are verified: (1) STATE_URL stat...", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5a0758d3-9826-5abc-9d6a-9a85afc46191", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12165 affects Undertow versions before 1.4.17, 1.3.31, and 2.0.0. The target version 2.3.24.Final already contains the upstream fix (commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f by Stuart Douglas) that was included in Undertow 2.0.0.Beta1. The fix adds comprehensive validation to prevent HTTP request smuggling via unusual whitespace or invalid characters in headers. All defense mech...", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e000726e-c3b8-52cf-9105-0ddcdebd5f8e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is NOT present in Undertow 2.3.24.Final. The vulnerability concerned missing URI validation in Digest authentication, allowing MITM attacks via URI mismatch between the Authorization header and HTTP request line. The upstream vendor (Stuart Douglas) fixed this via commits facb33a5c and 8804170c, which add comprehensive URI validation (both relative and absolute forms) to DigestAu...", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:203783af-779f-5131-9cde-6309d559ec13", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 is not present in this version. The vulnerability was fixed in upstream Undertow commits 1e72647818c9 (JBEAP-9909) and 3436b03eda8b (UNDERTOW-1165), both authored by stuart.w.douglas@gmail.com. These fixes were already included in the upstream 2.3.24.Final release that TuxCare onboarded in commit a7d66ffbd. The target has all required defenses: ALLOWED_TOKEN_CHARACTERS validation ...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b3a4e075-92b8-5f7f-b0f3-a3eccade5a00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2670 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. The target repository (Undertow 2.3.24.Final) is NOT affected by CVE-2017-2670. The vulnerability involves a WebSocket server getting stuck in an infinite loop on IO threads when handling non-clean TCP close events. The upstream fix (commit 9bfe9fbbb595d51157b61693f072895f7dbadd1d by Stuart Douglas) was already present in the upstream release 2.3.24.Final that TuxCare onboarded. The fix adds STATE_STREAM_BROKEN to the loop exit condition in AbstractFramedStreamSourceChannel.java at line 320, ensuring the read listener loop terminates when the stream is broken, preventing the infinite loop and DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bdc0db8c-7d62-5326-a83d-abdb8daabd70", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 Undertow 2.3.24.Final-tuxcare.1 is not affected by CVE-2017-7559. The vulnerability concerns invalid characters being allowed in query strings and path parameters, which could enable HTTP response manipulation. The fix that validates and rejects invalid characters using the ALLOWED_TARGET_CHARACTER array was added by the upstream vendor (Stuart Douglas) in commit 1e72647818 on 2017-03-30. This ...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:53a55cb8-0b0e-54a7-a33a-425ec9217dfb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 describes a file descriptor leak in URLResource.getLastModified() when handling JAR URLs. The vulnerability occurs when calling connection.getLastModified() on JarURLConnection objects, which opens file descriptors that are only closed on finalization. The fix was applied upstream in commit 882d5884f (April 2018) by Norito Agetsuma, 8 years before the 2.3.24.Final release. The vul...", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:28f7dc95-2b6f-5453-8224-d0128384270d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-14642 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 is not present in Undertow 2.3.24.Final. The vulnerability involved writing more bytes than were populated in a buffer array (using data.length instead of the actual populated count), potentially leaking stale data from previous requests. The fix (commit a83b047d5) was shipped in upstream release 2.3.24.Final and changes line 157 of HttpResponseConduit.java from `next.write(data,...", "justification": "code_not_present" } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6c083ca1-fc47-5bd7-8047-97a862a7faa8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-10212 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2019-10212 is not present in Undertow 2.3.24.Final. The vulnerability involved credentials being logged in plaintext at DEBUG level in io.undertow.request.security logs. The upstream vendor applied two fixes (UNDERTOW-1576 and UNDERTOW-1515) that were already included in the 2.3.24.Final release before TuxCare onboarded it. The fixes remove credential values from debug log statements in BasicAuthenticationMechanism and prevent headers from being included in HttpServerExchange.toString().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:41d83b9a-291c-56f3-8f18-86a7efbf4a1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-14888 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. Target version 2.3.24.Final is not affected by CVE-2019-14888. The upstream release includes alternative fixes for the deadlock vulnerability (UNDERTOW-1623) that use a different approach than the original fix in 2.0.29.Final. Specifically, commits 8217c4690 and 89393112c move queueFrame operations outside synchronized blocks to prevent the circular lock dependency that causes the DOS deadlock. These upstream fixes were shipped in the 2.3.24.Final release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.29.Final), NVD (<= 2.0.28), cve.org (< 2.0.28.SP1), Snyk (< 2.0.29.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c949d5ff-3c8d-57b9-a422-1ffb88b369df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3888 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2019-3888 is not present in target Undertow 2.3.24.Final. Both required fixes are present: (1) HttpServerExchange.toString() no longer includes request/response headers that could contain credentials, and (2) BasicAuthenticationMechanism no longer logs plaintext credentials at DEBUG level. Both fixes were included in the upstream 2.3.24.Final release before TuxCare onboarding, authored by Carter Kozak (ckozak@ckozak.net) and Paramvir Jindal (pjindal@pjindal.pnq.csb). The vulnerable code pattern described in the CVE - credentials exposed when HttpServerExchange is logged at ERROR level - cannot occur because toString() excludes headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7e4f40f2-797f-58ab-9a7c-9f9f48d90037", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10687 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 Undertow 2.3.24.Final is NOT AFFECTED by CVE-2020-10687. All required fixes for HTTP request smuggling (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) were included in upstream release 2.2.0.Final (September 2020), well before this version. The target contains all defense mechanisms: (1) HTTP/1.x request target character validation via ALLOWED_TARGET_CHARACTER array, (2) HTTP/2 pseudo-header vali...", "justification": "code_not_present" } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:83115235-8d31-5f5f-abff-20638501a209", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10705 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. The target repository (Undertow 2.3.24.Final) is NOT affected by CVE-2020-10705. All three fix commits for UNDERTOW-1657 (64bbaeb7c, aa5e1fe11, b53d4589c) that address the Expect: 100-continue buffer leak vulnerability are present in HEAD and were shipped in the upstream Undertow 2.3.24.Final release before TuxCare onboarded it. The vulnerable pattern (unreleased buffers causing memory exhaustion) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:35873567-9bb8-5ae1-8387-bab1102b2f60", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10719 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 addresses an integer overflow vulnerability in HTTP chunked transfer encoding parsing that could lead to request smuggling. The target repository (Undertow 2.3.24.Final-tuxcare.1) is NOT affected because the upstream vendor fix is already present. The fix commit (bfc8fbd67) by Red Hat was shipped in upstream release 2.3.24.Final, which TuxCare subsequently onboarded. The overflow...", "justification": "code_not_present" } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5a079d04-04c8-5f7b-9745-e5227622e74b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1745 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2020-1745 is NOT present in Undertow 2.3.24.Final-tuxcare.1. The vulnerability was a file inclusion issue in the AJP connector that allowed attackers to read arbitrary files or achieve RCE by sending crafted AJP request attributes with malicious names (e.g., javax.servlet.include.request_uri). The fix (UNDERTOW-1667) validates attribute names against a known-safe list and drops unknown attributes unless they match an admin-configured pattern. This fix was introduced in upstream version 2.0.30.Final (February 2020) and is present in the target's upstream base 2.3.24.Final, which TuxCare onboarded without modification to the AJP parser code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).", "justification": "code_not_present" } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0f77c5d8-946e-59f2-b85b-2e2276eddb1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:33a76a7d-f509-5b79-8db1-97d923f12880", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27782 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2020-27782 fixes were already present in upstream Undertow 2.3.24.Final. The target contains both required patches: UNDERTOW-1404 (IllegalArgumentException handling for malformed AJP query strings) and UNDERTOW-1824 (proper AJP protocol error responses). Both fixes were authored by upstream developers (Red Hat/community) and shipped in the 2.3.24.Final release that TuxCare onboarded. The vulnerable pattern (uncaught exceptions and abrupt connection termination from non-RFC compliant query strings) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c92ca2f6-3755-58bd-9cd7-b7885e0e1dcd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-20220 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-20220 (HTTP request smuggling via invalid characters in HTTP/2 pseudo-headers) is NOT present in Undertow 2.3.24.Final-tuxcare.1. The upstream fix (UNDERTOW-1780, commit a18574a4d) was already included in version 2.3.24.Final that TuxCare onboarded. The target code validates all HTTP/2 pseudo-headers (:path, :scheme, :authority, :method) against strict character allowlists in Http2Rece...", "justification": "code_not_present" } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:78bee090-571a-503e-88b3-b643ecb9a559", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3597 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 affects Undertow versions prior to 2.0.39.Final and 2.2.9.Final, where HTTP2SourceChannel fails to write the final frame under certain circumstances, causing denial of service. The target version 2.3.24.Final-tuxcare.1 is NOT AFFECTED because the upstream release 2.3.24.Final already contained the fix (commit b92904715 by frainone@redhat.com, merged Feb 2021). The fix ensures that...", "justification": "code_not_present" } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:575182b8-f502-588b-be1b-94b1251c16d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3629 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.3.24.Final is not affected by CVE-2021-3629. The vulnerability (HTTP/2 flow control DoS via indefinite blocking when peer doesn't send WINDOW_UPDATE frames) was fixed in the upstream release before TuxCare onboarded it. Three related fix commits (UNDERTOW-1910, UNDERTOW-2034, UNDERTOW-2056) authored by RedHat engineers between July 2021 and March 2022 are all present in th...", "justification": "code_not_present" } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3d728f12-75c8-5596-b7bf-a3c35a4cc606", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3690 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. The target Undertow version 2.3.24.Final-tuxcare.1 is not affected by CVE-2021-3690. The vulnerability (buffer leak on incoming WebSocket PONG messages leading to memory exhaustion) was fixed in upstream Undertow by commit c7e84a0b7 on 2021-07-31, authored by Andrey Marinchuk. This fix was included in upstream versions 2.0.40 and 2.2.10, and was already present in version 2.3.24.Final when TuxCare onboarded it on 2024+. The vulnerable code pattern (missing buffer deallocation in the else-branch of the PONG message handler) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:00363554-15b8-5dd4-832e-c91beaab71f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3859 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2021-3859 affects Undertow versions < 2.2.15.Final due to incorrect HTTP/2 continuation frame handling. The target version 2.3.24.Final-tuxcare.1 is not affected because the upstream fix (commit e43f0ada3) was already present in the 2.3.24.Final release that TuxCare onboarded. The fix modifies Http2Channel.parseFrame() to consume all available continuation frames in a do-while loop instead of returning null when continuation is needed, and corrects iterator advancement in HpackEncoder to prevent skipping headers during overflow. Both fixes are verified present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bf51cef1-4b36-51a2-aca2-aef9b2912939", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-2053 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. Target version 2.3.24.Final already contains the upstream fix for CVE-2022-2053. The fix (commit 2825b026d, dated 2022-07-25) adds a specific catch block for RequestTooBigException in AjpServerRequestConduit.java that re-throws the exception, allowing proper error handling upstream instead of silently closing the connection. This fix was present in the upstream release 2.3.24.Final before TuxCare onboarded it in 2026-07-13, making it an upstream fix rather than a TuxCare backport. The vulnerable pattern (silent connection closure on oversized POST requests via AJP) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2).", "justification": "code_not_present" } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:cc48ad65-3d31-5982-9ee6-546c63f4849b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-4492 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2022-4492 affects Undertow client SSL/TLS connections that lack hostname verification. The target version 2.3.24.Final is NOT AFFECTED because the upstream fix was already present in the release before TuxCare onboarded it. The fix (commit e5071e52b by rmartinc@redhat.com) configures ENDPOINT_IDENTIFICATION_ALGORITHM to \"HTTPS\" by default in HttpClientProvider and Http2ClientProvider, enabling hostname verification during TLS handshakes. The vulnerable pattern (missing endpoint identification) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9c034aa4-29ae-57cd-941b-5db39549bf8f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-1108 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. The target repository (Undertow 2.3.24.Final) is NOT affected by CVE-2023-1108. The vulnerability described an infinite loop in SslConduit.wrapAndFlip() when the SSL engine's inbound side is done but handshake status is NEED_WRAP. The fix (adding `&& !engine.isInboundDone()` to the while loop condition) was already present in the upstream 2.3.24.Final release before TuxCare onboarding. This fix was authored by Flavia Rainone from Red Hat (frainone@redhat.com) and merged into upstream in February 2023, appearing in Undertow versions 2.3.5.Final and later.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9f6c60ac-50c8-5519-9874-7add3533ec72", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-1973 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2023-1973 does not affect Undertow version 2.3.24.Final because the upstream vendor fix (commit 0410f3c4d) was already present in the upstream release when TuxCare onboarded it. The fix limits authentication session timeout to 120 seconds to prevent memory exhaustion attacks. Both affected files (FormAuthenticationMechanism.java and ServletFormAuthenticationMechanism.java) contain the complete defensive code that prevents unbounded session accumulation during form authentication.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final), Snyk (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:626c070c-82f3-59e3-83d9-4bdea25e2395", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-4639 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2023-4639 describes a cookie parsing vulnerability in Undertow where improperly quoted cookie values (missing closing quotes before delimiters) could allow attackers to exfiltrate HttpOnly cookies or spoof additional cookies. The target repository (io.undertow:undertow-parent version 2.3.24.Final-tuxcare.1) already contains the upstream fix that was shipped in the upstream 2.3.24.Final release before TuxCare onboarded it. The fix (commit 1f93a979d2, author baranowb@gmail.com, committer frainone@redhat.com from Red Hat) correctly handles unterminated quoted values by resetting the parser state when a delimiter (semicolon or comma) is encountered before the closing quote in the parseCookie state machine (lines 378-380 of Cookies.java). All cookie parsing entry points route through this fixed method, and no alternative parsing paths exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.11.Final; < 2.2.30.Final), Snyk (< 2.2.30.Final; >= 2.3.0.Alpha1, < 2.3.11.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bdbf2004-fedb-5db6-8da4-bcd3c36155ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1459 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2024-1459 path traversal vulnerability is NOT present in target version 2.3.24.Final-tuxcare.1. The upstream fix (commit 9b7c5037e by Red Hat developers) was already included in the upstream release 2.3.24.Final when TuxCare onboarded it. The defense code that preserves semicolons in dot-segments to prevent \"/..;\" from being treated as \"/..\" is present and active in HttpRequestParser.java a...", "justification": "code_not_present" } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:28c27e2e-e912-5360-b62b-63de07c3c3c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1635 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. The target repository (undertow 2.3.24.Final at SHA 52bf3747d) is NOT AFFECTED by CVE-2024-1635. The vulnerability fix was already present in the upstream 2.3.24.Final release when TuxCare onboarded it. The fix introduces a connection close listener and synchronization mechanisms to prevent timeout handle leaks when connections are closed during HTTP-to-remoting upgrade, addressing the resource exhaustion vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Final, < 2.3.12.Final; < 2.2.31.Final), cve.org (= 1.31.0), Snyk (< 2.2.31.Final; >= 2.3.0.Final, < 2.3.12.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0a41cbaf-e658-5180-b709-3a230f594863", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-3653 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2024-3653 affects the LearningPushHandler in Undertow when maxAge is left at the default value of -1, allowing unbounded memory consumption. The vulnerability was fixed in upstream commits 6b8e79c16 and a03e5189b, which replaced unbounded HashMaps with size-limited LRUCache instances. These fixes were already present in upstream release 2.3.24.Final when TuxCare onboarded it on 2026-07-13. ...", "justification": "code_not_present" } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6ff08200-a169-5a92-ab3b-02bdb707e6a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e988c546-0b37-50bc-810f-d532f6bf6fa5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-4027 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 2.3.21.Final, and version 2.3.24.Final is a later release of the same line. Advisories: GitHub GHSA-33hj-rcmx-86mv (fixed in 2.3.21.Final), Snyk (fixed in 2.3.21.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8917c72c-ed68-5a27-8847-aaebf5c66d6f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.3.24.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3f803143-cec2-59c9-861c-adf59a9618b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-5971 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2024-5971 fix is present in target Undertow 2.3.24.Final. The vulnerability (incorrect byte accounting in SSL wrapping causing chunked responses to hang without sending the 0\\r\\n terminator) was fixed by upstream commit 1418733c9 authored by Flavia Rainone (Red Hat). This fix shipped in upstream Undertow 2.3.24.Final before TuxCare onboarded the version, making it an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.15.Final; < 2.2.34.Final), cve.org (< 2.2.34.Final; >= 2.3.0.Alpha1, < 2.3.15.Final), Snyk (< 2.2.34.Final; >= 2.3.0.Final, < 2.3.8.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:527a5553-8b62-52f4-94ec-ffeda79392c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6162 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2024-6162: Target version 2.3.24.Final-tuxcare.1 is NOT AFFECTED. The vulnerability (shared decodeBuffer StringBuilder causing path confusion in AJP requests) was fixed in upstream commit 90f202ada by Tomas Hofman (Red Hat) before the 2.3.24.Final release. TuxCare onboarded the already-fixed upstream version. The vulnerable pattern (instance field 'private StringBuilder decodeBuffer;' reused across requests) is absent; the target uses the fixed pattern (local 'final StringBuilder decodeBuffer = new StringBuilder();' created fresh per decode operation at line 532 of AjpRequestParser.java).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.14.Final; < 2.2.33.Final), cve.org (< 2.2.33.Final; >= 2.3.0.Alpha1, < 2.3.14), Snyk (< 2.2.33.Final; >= 2.3.0.Final, < 2.3.14.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9a329492-2569-5bd0-bb0e-aaa9b9f8b2f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-7885 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. The upstream fix was released in 2.3.17.Final, and version 2.3.24.Final is a later release of the same line. Advisories: GitHub GHSA-9623-mqmm-5rcf (fixed in 2.3.17.Final), CVE record (fixed in 2.3.17.Final), Snyk (fixed in 2.3.17.Final).", "justification": "code_not_present" } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f33f10ed-6686-5521-9a00-da640d19dd83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-12543 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. The target repository (Undertow 2.3.24.Final-tuxcare.1) is NOT AFFECTED by CVE-2025-12543. The vulnerability fix was already present in the upstream Undertow 2.3.24.Final release before TuxCare onboarded it. The HostHeaderHandler defense mechanism is fully integrated and automatically validates all incoming HTTP requests, rejecting malformed/missing/multiple Host headers with HTTP 400, preventing cache poisoning, network scanning, and session hijacking attacks described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.21.Final; < 2.2.39.Final), NVD (< 2.2.39; >= 2.3.0, < 2.3.21), Snyk (< 2.2.39.Final; >= 2.3.0.Alpha1, < 2.3.21.Final; >= 2.4.0.Alpha1, < 2.4.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7e60093b-53d6-5dcf-85d6-4ebe2e7aa8fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-9784 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2025-9784 (MadeYouReset HTTP/2 DoS attack) is NOT present in undertow 2.3.24.Final-tuxcare.1. The vulnerability allowed attackers to trigger excessive server-side RST_STREAM frames without triggering abuse counters, causing denial of service. The complete fix was already present in upstream version 2.3.24.Final when TuxCare onboarded it on 2026-07-13. The fix adds tracking of SENT RST frames (not just received), enforces rate limits on outgoing RST frames, and sends GOAWAY with ERROR_ENHANCE_YOUR_CALM when limits are exceeded. All three fix components are verified present in the target code. The fix was authored by frainone@redhat.com (Red Hat/upstream Undertow), not TuxCare, making this an upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.38.Final; >= 2.3.0.Alpha1, < 2.3.20.Final), cve.org (< 2.2.38.Final), Snyk (< 2.2.38.Final; >= 2.3.0.Alpha1, < 2.3.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ad367db1-a6b2-5665-88bf-f73c1cb5503a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:edc6c1b7-4360-5cd3-a064-2683ce5943c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4fc6719a-a833-5aa7-abb7-7898d44c2661", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:dc128ad6-162e-5401-8590-45c478d5dbff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3260 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. already_fixed \u2014 The target repository (Undertow 2.3.24.Final) already contains the fix for CVE-2026-3260. The upstream fix (UNDERTOW-2677) was included in version 2.3.24.Final before it was onboarded to TuxCare. The fix prevents the multipart parser from overriding application-configured entity size limits.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1" } ] }