{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:526c4041-2a7d-5d3d-b38b-bfe21eda34f8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-parent",
      "purl": "pkg:maven/io.undertow/undertow-parent@2.2.37.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-parent@2.2.37.Final-tuxcare.1",
      "version": "2.2.37.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-parent",
            "purl": "pkg:maven/io.undertow/undertow-parent@2.2.37.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.2.37.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-3223",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.2.37.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:44394a77-1b18-5462-96c0-7df52e6aa252",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-3223 does not affect version 2.2.37.Final-tuxcare.1 of io.undertow:undertow-parent. CVE-2023-3223 is not present in undertow 2.2.37.Final. The vulnerability, which allowed bypassing fileSizeThreshold by setting filename to null in multipart uploads (causing OutOfMemoryError), was fixed in upstream commit 86209e5dd by Lin Gao. This fix shipped in the upstream 2.2.37.Final release before TuxCare began maintaining this version. The target code contains the complete fix: fieldSizeThreshold field, MINSIZE constant, and the modified condition in data() method that persists large content to disk even when filename is null.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.24.Final), NVD (< 2.2.24), Snyk (< 2.2.27.Final; >= 2.3.0.Alpha1, < 2.3.9.Final; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-28367",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.2.37.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:05e91927-a838-5439-bf31-48774ee413f4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28367 affects version 2.2.37.Final-tuxcare.1 of io.undertow:undertow-parent."
      }
    },
    {
      "id": "CVE-2026-28368",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.2.37.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9ea6aef6-9bc8-5d92-9cc7-eef99419eb49",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28368 affects version 2.2.37.Final-tuxcare.1 of io.undertow:undertow-parent."
      }
    },
    {
      "id": "CVE-2026-28369",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.2.37.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f2ae9c30-0e41-523d-87fd-0e02661f977e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28369 affects version 2.2.37.Final-tuxcare.1 of io.undertow:undertow-parent."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-parent@2.2.37.Final-tuxcare.1"
    }
  ]
}