{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:18d1200b-6c56-5717-9faf-b6e1613d0e24",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-parent",
      "purl": "pkg:maven/io.undertow/undertow-parent@2.3.10.Final-tuxcare.8",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-parent@2.3.10.Final-tuxcare.8",
      "version": "2.3.10.Final-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-parent",
            "purl": "pkg:maven/io.undertow/undertow-parent@2.3.10.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.10.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-3223",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.10.Final-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c101423e-006e-578f-bb9e-9fd6f1df31a9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-3223 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-parent. CVE-2023-3223 fix was already present in upstream Undertow 2.3.10.Final before TuxCare onboarded the version. The vulnerability pattern (missing fieldSizeThreshold check allowing OOM when filename is omitted in multipart uploads) is not present in the target. The fix adds a fieldSizeThreshold (default 16KB) that triggers disk persistence even when filename is null, preventing unbounded memory accumulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.24.Final), NVD (< 2.2.24), Snyk (< 2.2.27.Final; >= 2.3.0.Alpha1, < 2.3.9.Final; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-28367",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.10.Final-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8f627895-68b2-5d07-ab4f-46edbef024c0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28367 affects version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-parent."
      }
    },
    {
      "id": "CVE-2026-28368",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.10.Final-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d7103484-c9bc-54cf-bdd3-a8dabc8f6fce",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28368 affects version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-parent."
      }
    },
    {
      "id": "CVE-2026-28369",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.10.Final-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c7747e3c-0332-573d-92a7-64110db5e52b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28369 affects version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-parent."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-parent@2.3.10.Final-tuxcare.8"
    }
  ]
}