{ "@id": "urn:uuid:a3c63050-3bc2-41f1-b7a8-e818d7ec6a77", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-01T04:20:00.619725+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2014-7816 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2014-7816" }, "action_statement": "Vulnerability CVE-2014-7816 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2016-7046 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2016-7046" }, "action_statement": "Vulnerability CVE-2016-7046 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-12165 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-12165" }, "action_statement": "Vulnerability CVE-2017-12165 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T23:48:00.112913+00:00", "status_notes": "Vulnerability CVE-2017-12196 does not affect version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2017-12196 is not present in this target. The vulnerability affected Undertow's Digest authentication mechanism, which failed to validate that the URI in the Authorization header matched the actual request URI, allowing MITM attacks. The vendor's fix (commits facb33a5c and 8804170ce) was already included in the upstream Undertow 2.3.20.Final release. When TuxCare onboarded version 2.3.20.Fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12196" }, "impact_statement": "not_affected \u2014 CVE-2017-12196 is not present in this target. The vulnerability affected Undertow's Digest authentication mechanism, which failed to validate that the URI in the Authorization header matched the actual request URI, allowing MITM attacks. The vendor's fix (commits facb33a5c and 8804170ce) was already included in the upstream Undertow 2.3.20.Final release. When TuxCare onboarded version 2.3.20.Fi..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2666 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2666" }, "action_statement": "Vulnerability CVE-2017-2666 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2670 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2670" }, "action_statement": "Vulnerability CVE-2017-2670 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:52:10.332998+00:00", "status_notes": "Vulnerability CVE-2017-7559 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-7559" }, "action_statement": "Vulnerability CVE-2017-7559 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T00:22:00.092322+00:00", "status_notes": "Vulnerability CVE-2018-1114 does not affect version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2018-1114 file descriptor leak in URLResource.getLastModified() is NOT present in the target. The fix was already included in upstream Undertow 2.3.20.Final before TuxCare onboarded this version. The vulnerable pattern (calling connection.getLastModified() on JarURLConnection without closing file descriptors) has been replaced with safe code that retrieves modification time directly from th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1114" }, "impact_statement": "not_affected \u2014 CVE-2018-1114 file descriptor leak in URLResource.getLastModified() is NOT present in the target. The fix was already included in upstream Undertow 2.3.20.Final before TuxCare onboarded this version. The vulnerable pattern (calling connection.getLastModified() on JarURLConnection without closing file descriptors) has been replaced with safe code that retrieves modification time directly from th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T04:20:00.619725+00:00", "status_notes": "Vulnerability CVE-2018-14642 does not affect version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 The target repository (Undertow 2.3.20.Final) is NOT AFFECTED by CVE-2018-14642. The vulnerability was an information leak where HttpResponseConduit.processWrite() wrote entire buffer arrays (data.length) instead of only populated portions (length + 1), potentially exposing data from previous requests. The fix (commit a83b047d5) was authored by upstream developer Stuart Douglas and was already ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14642" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.3.20.Final) is NOT AFFECTED by CVE-2018-14642. The vulnerability was an information leak where HttpResponseConduit.processWrite() wrote entire buffer arrays (data.length) instead of only populated portions (length + 1), potentially exposing data from previous requests. The fix (commit a83b047d5) was authored by upstream developer Stuart Douglas and was already ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-10184 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10184" }, "action_statement": "Vulnerability CVE-2019-10184 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-10212 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10212" }, "action_statement": "Vulnerability CVE-2019-10212 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-14888 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-14888" }, "action_statement": "Vulnerability CVE-2019-14888 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-3888 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-3888" }, "action_statement": "Vulnerability CVE-2019-3888 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T03:29:00.119787+00:00", "status_notes": "Vulnerability CVE-2020-10687 does not affect version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2020-10687 affects Undertow versions before 2.2.0.Final. The target (Undertow 2.3.20.Final-tuxcare.1) contains all necessary fixes for this HTTP request smuggling vulnerability. Three upstream fix commits (UNDERTOW-1165, UNDERTOW-1780, UNDERTOW-1774) adding strict character validation to HTTP/1.x and HTTP/2 parsers are present in HEAD and were shipped in the upstream 2.3.20.Final release. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10687" }, "impact_statement": "not_affected \u2014 CVE-2020-10687 affects Undertow versions before 2.2.0.Final. The target (Undertow 2.3.20.Final-tuxcare.1) contains all necessary fixes for this HTTP request smuggling vulnerability. Three upstream fix commits (UNDERTOW-1165, UNDERTOW-1780, UNDERTOW-1774) adding strict character validation to HTTP/1.x and HTTP/2 parsers are present in HEAD and were shipped in the upstream 2.3.20.Final release. T..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-10705 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-10705" }, "action_statement": "Vulnerability CVE-2020-10705 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T02:34:48.218490+00:00", "status_notes": "Vulnerability CVE-2020-10719 does not affect version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2020-10719 (HTTP request smuggling via chunk size integer overflow) is NOT present in Undertow 2.3.20.Final. The vulnerability allowed attackers to send extremely large chunk size values that would overflow during hex-to-decimal parsing, wrapping to small values and causing incorrect chunk boundary detection. The upstream fix (commit bfc8fbd67) added a LIMIT validation check before accumula...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10719" }, "impact_statement": "not_affected \u2014 CVE-2020-10719 (HTTP request smuggling via chunk size integer overflow) is NOT present in Undertow 2.3.20.Final. The vulnerability allowed attackers to send extremely large chunk size values that would overflow during hex-to-decimal parsing, wrapping to small values and causing incorrect chunk boundary detection. The upstream fix (commit bfc8fbd67) added a LIMIT validation check before accumula..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1745 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1745" }, "action_statement": "Vulnerability CVE-2020-1745 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1757 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1757" }, "action_statement": "Vulnerability CVE-2020-1757 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-27782 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-27782" }, "action_statement": "Vulnerability CVE-2020-27782 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T03:48:00.089636+00:00", "status_notes": "Vulnerability CVE-2021-20220 does not affect version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 The target repository (Undertow 2.3.20.Final-tuxcare.1) is NOT AFFECTED by CVE-2021-20220. All required fixes for this HTTP request smuggling vulnerability were already present in the upstream 2.3.20.Final release that TuxCare onboarded. The fixes include: (1) HTTP/2 pseudo-header validation for :path, :scheme, :authority, and :method headers to reject invalid characters (UNDERTOW-1780), and (2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20220" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.3.20.Final-tuxcare.1) is NOT AFFECTED by CVE-2021-20220. All required fixes for this HTTP request smuggling vulnerability were already present in the upstream 2.3.20.Final release that TuxCare onboarded. The fixes include: (1) HTTP/2 pseudo-header validation for :path, :scheme, :authority, and :method headers to reject invalid characters (UNDERTOW-1780), and (2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T23:40:00.392806+00:00", "status_notes": "Vulnerability CVE-2021-3597 does not affect version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-3597 (UNDERTOW-1842) describes a denial of service where HTTP2SourceChannel fails to write the final frame under certain conditions. The upstream fix (commit b929047) was already included in Undertow version 2.3.20.Final before TuxCare onboarded this version. The vulnerable pattern does not exist in the target code because the fix is present at AbstractFramedStreamSinkChannel.flushComp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3597" }, "impact_statement": "not_affected \u2014 CVE-2021-3597 (UNDERTOW-1842) describes a denial of service where HTTP2SourceChannel fails to write the final frame under certain conditions. The upstream fix (commit b929047) was already included in Undertow version 2.3.20.Final before TuxCare onboarded this version. The vulnerable pattern does not exist in the target code because the fix is present at AbstractFramedStreamSinkChannel.flushComp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T00:11:00.126304+00:00", "status_notes": "Vulnerability CVE-2021-3629 does not affect version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 The target (Undertow 2.3.20.Final) is not affected by CVE-2021-3629. The vulnerability affects versions prior to 2.0.40.Final and prior to 2.2.11.Final. Version 2.3.20.Final is newer and already contains the upstream fix from UNDERTOW-1910 (commit a4e7b1dbd), which was shipped in the upstream release before TuxCare onboarding. The fix changes AbstractFramedStreamSinkChannel.awaitWritable() from...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3629" }, "impact_statement": "not_affected \u2014 The target (Undertow 2.3.20.Final) is not affected by CVE-2021-3629. The vulnerability affects versions prior to 2.0.40.Final and prior to 2.2.11.Final. Version 2.3.20.Final is newer and already contains the upstream fix from UNDERTOW-1910 (commit a4e7b1dbd), which was shipped in the upstream release before TuxCare onboarding. The fix changes AbstractFramedStreamSinkChannel.awaitWritable() from..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3690 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3690" }, "action_statement": "Vulnerability CVE-2021-3690 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3859 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3859" }, "action_statement": "Vulnerability CVE-2021-3859 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2022-2053 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-2053" }, "action_statement": "Vulnerability CVE-2022-2053 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2022-4492 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-4492" }, "action_statement": "Vulnerability CVE-2022-4492 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1108 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1108" }, "action_statement": "Vulnerability CVE-2023-1108 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1973 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1973" }, "action_statement": "Vulnerability CVE-2023-1973 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-4639 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-4639" }, "action_statement": "Vulnerability CVE-2023-4639 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T01:50:00.378691+00:00", "status_notes": "Vulnerability CVE-2024-1459 does not affect version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2024-1459 path traversal vulnerability is not present in this target. The upstream fix (commit 9b7c5037e by Tomas Hofman/Flavia Rainone @redhat.com) was already included in Undertow 2.3.20.Final when TuxCare onboarded this version. The fix modifies HttpRequestParser.handlePath() to preserve semicolons in the canonical path when inside dot-segments (\".\" or \"..\"), preventing the malicious seq...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1459" }, "impact_statement": "not_affected \u2014 CVE-2024-1459 path traversal vulnerability is not present in this target. The upstream fix (commit 9b7c5037e by Tomas Hofman/Flavia Rainone @redhat.com) was already included in Undertow 2.3.20.Final when TuxCare onboarded this version. The fix modifies HttpRequestParser.handlePath() to preserve semicolons in the canonical path when inside dot-segments (\".\" or \"..\"), preventing the malicious seq..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-1635 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-1635" }, "action_statement": "Vulnerability CVE-2024-1635 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T23:34:00.095788+00:00", "status_notes": "Vulnerability CVE-2024-3653 does not affect version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 The target repository (Undertow 2.3.20.Final) is NOT AFFECTED by CVE-2024-3653. The vulnerability concerns unbounded cache growth in the LearningPushHandler when maxAge is configured to -1 (no expiry), allowing attackers to exhaust memory via HTTP requests with various Referer headers. However, the upstream 2.3.20.Final release already includes the fix commits (a03e5189b and 6b8e79c16) that add...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3653" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.3.20.Final) is NOT AFFECTED by CVE-2024-3653. The vulnerability concerns unbounded cache growth in the LearningPushHandler when maxAge is configured to -1 (no expiry), allowing attackers to exhaust memory via HTTP requests with various Referer headers. However, the upstream 2.3.20.Final release already includes the fix commits (a03e5189b and 6b8e79c16) that add..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3884 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-3884" }, "action_statement": "Vulnerability CVE-2024-3884 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4027 is fixed in version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-4027" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:54:17.970911+00:00", "status_notes": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-examples 2.3.20.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2024-4109" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-5971 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-5971" }, "action_statement": "Vulnerability CVE-2024-5971 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-6162 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-6162" }, "action_statement": "Vulnerability CVE-2024-6162 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-7885 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-7885" }, "action_statement": "Vulnerability CVE-2024-7885 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12543 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-12543" }, "action_statement": "Vulnerability CVE-2025-12543 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-9784 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-9784" }, "action_statement": "Vulnerability CVE-2025-9784 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.20.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3260 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2026-3260" }, "action_statement": "Vulnerability CVE-2026-3260 affects version 2.3.20.Final-tuxcare.1 of io.undertow:undertow-examples." } ] }