{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ea36118c-50e9-52e8-9319-4cca131b834e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-parser-generator", "purl": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1", "version": "1.4.27.Final-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5007ae07-6f7b-55c2-bb91-15df7a12fcc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5d11c062-bcdd-57be-b99f-add5f9188967", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ed270aa1-c4d1-50a7-8492-f60a6ced4bff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b0137114-916a-5176-82f5-e92ea4b6adb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2a3b63bd-99e5-5005-a39e-2ba3f1eae390", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d81d71c1-629d-51de-9e1c-aef67b7a59bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:017e502b-ffda-5c3c-a58c-5a10c8a0c197", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e451b32f-4e89-5c12-a08e-5b3b2425543e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:81e43c2a-df21-5012-93b3-8a3a059a050f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6fe01547-497a-553f-a9ee-fc7ea982b59e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:18db96f5-90f0-5e64-ae33-cd157395f007", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:fdeff7ca-ec1a-5aaa-a7f4-c4a149128daa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:051c0726-89cb-5b4a-a228-b1457071a69a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3c0b3026-ee26-5ad0-b4f4-4281df4cdef1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f8e95bee-c7ee-5f5e-ba60-26fb6496f551", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0c75e927-16b9-5c8d-a0d6-c8c912919fd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9a3a1a81-bee7-56a8-99db-86091478f3f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:27eec273-440a-5622-9eb2-04b986b5a72b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7762557a-2e78-50f0-9d0d-c67e5d216379", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:be8ac38e-c2b6-5a28-9259-ebe4a2fc4a5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:076e5d8c-8063-56de-979b-e21e3d9411ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:24f0390f-592e-55ec-a2a9-3c92c95bf015", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:fb8169cc-1f80-570a-b4ed-424be8e0612b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:177c7d10-7c15-5e72-90df-70c180674b1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:414cfac2-cb13-5352-aa27-287623c0cc06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6bf5de41-697d-5ab3-a8d4-d2e5cb769f7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:cbf1703d-5ebe-5434-9cfd-8835fc643547", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:25a8eca9-9f82-5556-a632-cbc3d3831784", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4db9ba8a-465c-5bbf-bb4b-041d4bfda993", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b6253112-3af4-50c4-acaf-3cac321ebc62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0b90ad39-db7d-5085-af06-41c5af840e23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b36f5b8a-7f0c-5cc6-a848-77eb61942589", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:520d28f5-eb28-5df3-8886-c53a2f48457a", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-parser-generator 1.4.27.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9843b134-0f6d-5383-9681-4fae32fed998", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f988ab55-b81f-565b-a465-edc1a4aa73b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f4399ef5-f02f-5314-8f69-6ec69366e67b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:25128903-bc44-5610-80ed-c2a414bacd58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b72cfbb4-08d6-5aae-92ab-f523dc59cd63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:74cbbae8-b31e-5518-8a15-bb6677f4d4c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:54b4cda1-154e-5a26-9c33-d2ecf51f8648", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e7c6df05-7444-5977-89c6-f5a96ca201cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a174896b-f383-5bb0-a657-6870dc0031f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@1.4.27.Final-tuxcare.1" } ] }