{ "@id": "urn:uuid:b63f65d1-106e-48d0-9bc2-acac7942fd69", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-01T04:18:00.065830+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2014-7816 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2014-7816" }, "action_statement": "Vulnerability CVE-2014-7816 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2016-7046 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2016-7046" }, "action_statement": "Vulnerability CVE-2016-7046 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-12165 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-12165" }, "action_statement": "Vulnerability CVE-2017-12165 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-31T23:47:00.145303+00:00", "status_notes": "Vulnerability CVE-2017-12196 does not affect version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples. not_affected \u2014 CVE-2017-12196 affects Undertow's Digest authentication where the server fails to validate that the URI in the Authorization header matches the actual HTTP request URI, enabling MITM attacks. The target version 2.2.33.Final-tuxcare.6 contains the complete fix (commits facb33a5c and 8804170ce) which validates URI matching for both relative and absolute URIs. Both fix commits were authored by Stu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12196" }, "impact_statement": "not_affected \u2014 CVE-2017-12196 affects Undertow's Digest authentication where the server fails to validate that the URI in the Authorization header matches the actual HTTP request URI, enabling MITM attacks. The target version 2.2.33.Final-tuxcare.6 contains the complete fix (commits facb33a5c and 8804170ce) which validates URI matching for both relative and absolute URIs. Both fix commits were authored by Stu..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2666 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2666" }, "action_statement": "Vulnerability CVE-2017-2666 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2670 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2670" }, "action_statement": "Vulnerability CVE-2017-2670 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-29T10:52:10.332998+00:00", "status_notes": "Vulnerability CVE-2017-7559 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-7559" }, "action_statement": "Vulnerability CVE-2017-7559 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-11-01T00:20:00.208792+00:00", "status_notes": "Vulnerability CVE-2018-1114 does not affect version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples. not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-1114. The vulnerability (file descriptor leak in URLResource.getLastModified() for JAR URLs) was fixed in upstream commit 882d5884f authored by Norito Agetsuma. This fix was already present in the upstream 2.2.33.Final release that TuxCare onboarded. The vulnerable code pattern (calling connection.getLastModified() directly for jar:// URLs witho...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1114" }, "impact_statement": "not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-1114. The vulnerability (file descriptor leak in URLResource.getLastModified() for JAR URLs) was fixed in upstream commit 882d5884f authored by Norito Agetsuma. This fix was already present in the upstream 2.2.33.Final release that TuxCare onboarded. The vulnerable code pattern (calling connection.getLastModified() directly for jar:// URLs witho..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-11-01T04:18:00.065830+00:00", "status_notes": "Vulnerability CVE-2018-14642 does not affect version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples. not_affected \u2014 CVE-2018-14642 (information leak via buffer overflow in HTTP response writing) is NOT present in the target repository. The vulnerability involved writing the entire buffer array (data.length) instead of only the populated bytes (length + 1), causing data from previous requests to leak into the current response. The fix was applied by upstream author Stuart Douglas in commit a83b047d57 on 2018-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14642" }, "impact_statement": "not_affected \u2014 CVE-2018-14642 (information leak via buffer overflow in HTTP response writing) is NOT present in the target repository. The vulnerability involved writing the entire buffer array (data.length) instead of only the populated bytes (length + 1), causing data from previous requests to leak into the current response. The fix was applied by upstream author Stuart Douglas in commit a83b047d57 on 2018-..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-10184 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10184" }, "action_statement": "Vulnerability CVE-2019-10184 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2019-10212 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10212" }, "action_statement": "Vulnerability CVE-2019-10212 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-14888 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-14888" }, "action_statement": "Vulnerability CVE-2019-14888 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-3888 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-3888" }, "action_statement": "Vulnerability CVE-2019-3888 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-11-01T03:30:18.456848+00:00", "status_notes": "Vulnerability CVE-2020-10687 does not affect version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples. not_affected \u2014 CVE-2020-10687 affects Undertow versions before 2.2.0.Final due to HTTP request smuggling through invalid character handling. The target is Undertow 2.2.33.Final, which includes all three upstream fixes (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) that address this CVE. The fixes validate HTTP request components against allowed-character arrays, reject control characters (tabs, newlines, CR) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10687" }, "impact_statement": "not_affected \u2014 CVE-2020-10687 affects Undertow versions before 2.2.0.Final due to HTTP request smuggling through invalid character handling. The target is Undertow 2.2.33.Final, which includes all three upstream fixes (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) that address this CVE. The fixes validate HTTP request components against allowed-character arrays, reject control characters (tabs, newlines, CR) w..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-10705 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-10705" }, "action_statement": "Vulnerability CVE-2020-10705 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-11-01T02:32:36.583439+00:00", "status_notes": "Vulnerability CVE-2020-10719 does not affect version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples. not_affected \u2014 CVE-2020-10719 is not present in the target. The vulnerability involved integer overflow when parsing HTTP chunked transfer-encoding chunk sizes, which could enable request smuggling. The upstream vendor (Red Hat) fixed this in commit bfc8fbd67 by adding a limit check (Long.MAX_VALUE >> 4) before chunk size accumulation. This fix was already present in the upstream release 2.2.33.Final that Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10719" }, "impact_statement": "not_affected \u2014 CVE-2020-10719 is not present in the target. The vulnerability involved integer overflow when parsing HTTP chunked transfer-encoding chunk sizes, which could enable request smuggling. The upstream vendor (Red Hat) fixed this in commit bfc8fbd67 by adding a limit check (Long.MAX_VALUE >> 4) before chunk size accumulation. This fix was already present in the upstream release 2.2.33.Final that Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1745 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1745" }, "action_statement": "Vulnerability CVE-2020-1745 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1757 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1757" }, "action_statement": "Vulnerability CVE-2020-1757 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-27782 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-27782" }, "action_statement": "Vulnerability CVE-2020-27782 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-11-01T03:46:00.265946+00:00", "status_notes": "Vulnerability CVE-2021-20220 does not affect version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples. not_affected \u2014 Target version 2.2.33.Final-tuxcare.6 is not affected by CVE-2021-20220. The vulnerability requires HTTP/2 pseudo-headers (:path, :scheme, :authority, :method) to accept invalid characters, enabling request smuggling attacks. The fix (commit a18574a4d from May 2020) adds byte-level validation for all HTTP/2 pseudo-headers and was already present in the upstream release 2.2.33.Final that TuxCare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20220" }, "impact_statement": "not_affected \u2014 Target version 2.2.33.Final-tuxcare.6 is not affected by CVE-2021-20220. The vulnerability requires HTTP/2 pseudo-headers (:path, :scheme, :authority, :method) to accept invalid characters, enabling request smuggling attacks. The fix (commit a18574a4d from May 2020) adds byte-level validation for all HTTP/2 pseudo-headers and was already present in the upstream release 2.2.33.Final that TuxCare..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-31T23:39:00.087158+00:00", "status_notes": "Vulnerability CVE-2021-3597 does not affect version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-3597 describes a denial of service vulnerability in Undertow where HTTP/2 final frames fail to be written under certain circumstances. The fix (UNDERTOW-1842) modifies AbstractFramedStreamSinkChannel.flushComplete() to requeue the final frame when flush completes with remaining body data. This fix is present in the target at commit b92904715c5f5857827cf4201b9bce5844919259, authored by ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3597" }, "impact_statement": "not_affected \u2014 CVE-2021-3597 describes a denial of service vulnerability in Undertow where HTTP/2 final frames fail to be written under certain circumstances. The fix (UNDERTOW-1842) modifies AbstractFramedStreamSinkChannel.flushComplete() to requeue the final frame when flush completes with remaining body data. This fix is present in the target at commit b92904715c5f5857827cf4201b9bce5844919259, authored by ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-11-01T00:10:00.106947+00:00", "status_notes": "Vulnerability CVE-2021-3629 does not affect version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-3629 (UNDERTOW-1910) affects Undertow versions prior to 2.0.40.Final and 2.2.11.Final due to infinite blocking in HTTP/2 flow control handling. The target repository at version 2.2.33.Final-tuxcare.6 already contains the upstream fix (commit a4e7b1dbd) that adds timeout protection to AbstractFramedStreamSinkChannel.awaitWritable(). The fix was authored by frainone@redhat.com and shippe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3629" }, "impact_statement": "not_affected \u2014 CVE-2021-3629 (UNDERTOW-1910) affects Undertow versions prior to 2.0.40.Final and 2.2.11.Final due to infinite blocking in HTTP/2 flow control handling. The target repository at version 2.2.33.Final-tuxcare.6 already contains the upstream fix (commit a4e7b1dbd) that adds timeout protection to AbstractFramedStreamSinkChannel.awaitWritable(). The fix was authored by frainone@redhat.com and shippe..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3690 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3690" }, "action_statement": "Vulnerability CVE-2021-3690 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3859 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3859" }, "action_statement": "Vulnerability CVE-2021-3859 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2022-2053 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-2053" }, "action_statement": "Vulnerability CVE-2022-2053 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2022-4492 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-4492" }, "action_statement": "Vulnerability CVE-2022-4492 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1108 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1108" }, "action_statement": "Vulnerability CVE-2023-1108 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1973 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1973" }, "action_statement": "Vulnerability CVE-2023-1973 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-4639 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-4639" }, "action_statement": "Vulnerability CVE-2023-4639 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-11-01T01:48:00.122313+00:00", "status_notes": "Vulnerability CVE-2024-1459 does not affect version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples. not_affected \u2014 The target repository (Undertow 2.2.33.Final) is NOT affected by CVE-2024-1459. The upstream fix for this path traversal vulnerability (commit 40bb3314f013247af8e222870bd5045ca8650c5c) was already present in the upstream release version 2.2.33.Final when TuxCare onboarded it. The fix prevents the malicious sequence \"/..;/\" from being treated as a parent directory traversal operator by preservin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1459" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.2.33.Final) is NOT affected by CVE-2024-1459. The upstream fix for this path traversal vulnerability (commit 40bb3314f013247af8e222870bd5045ca8650c5c) was already present in the upstream release version 2.2.33.Final when TuxCare onboarded it. The fix prevents the malicious sequence \"/..;/\" from being treated as a parent directory traversal operator by preservin..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-1635 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-1635" }, "action_statement": "Vulnerability CVE-2024-1635 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3653 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples, and is fixed in 2.2.33.Final-tuxcare.6.", "vulnerability": { "name": "CVE-2024-3653" }, "action_statement": "Vulnerability CVE-2024-3653 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples, and is fixed in 2.2.33.Final-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3884 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-3884" }, "action_statement": "Vulnerability CVE-2024-3884 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4027 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-4027" }, "action_statement": "Vulnerability CVE-2024-4027 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-examples 2.2.33.Final-tuxcare.5.", "vulnerability": { "name": "CVE-2024-4109" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-5971 is fixed in version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-5971" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2024-6162 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-6162" }, "action_statement": "Vulnerability CVE-2024-6162 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-7885 is fixed in version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-7885" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12543 is fixed in version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-12543" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-9784 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-9784" }, "action_statement": "Vulnerability CVE-2025-9784 affects version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.33.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3260 is fixed in version 2.2.33.Final-tuxcare.5 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2026-3260" } } ] }