{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:90bc8c6e-52c5-5533-b83c-954122040662", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3", "version": "1.4.27.Final-tuxcare.3", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@1.4.27.Final", "type": "library", "group": "io.undertow", "version": "1.4.27.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:c1041bc5-68c3-53c6-8fd4-5cca1a7b129a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 is NOT present in target version 1.4.27.Final. The vulnerability (directory traversal on Windows via backslash in URIs) was fixed by upstream in commit 28f244e63 (UNDERTOW-338), which shipped in the upstream 1.4.27.Final release. TuxCare onboarded this already-fixed version at commit 1921b439b. All defense mechanisms are present: ResourceHandler, DefaultServlet, and ServletPathMat...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:2d7a41b4-33e8-51f3-8c35-28fa00bfc454", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 is not present in Undertow 1.4.27.Final. The vulnerability (BufferOverflowException from long URLs) was fixed in September 2016 by upstream commit 84e1227ed. This fix was already included in the upstream Undertow 1.4.27.Final release (March 2018) that TuxCare onboarded. All three components of the fix are present: (1) HttpRequestConduit.java has STATE_URL state and buffer length c...", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:851ada7d-ef3b-5523-a59a-0d3f1a928aa7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 1.4.27.Final is not affected by CVE-2017-12165. All three defensive mechanisms from the upstream fix are present: (1) RFC 7230 token character validation for header names and HTTP methods via Connectors.verifyToken(), (2) request-target character validation via ALLOWED_TARGET_CHARACTER array (enabled by default), and (3) header count validation via Connectors.areRequestHeade...", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:e88c76f7-132c-5064-a253-e07ce4c24d77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:da91f5e8-095c-5e5f-84c1-3bc097971ca0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 is NOT present in this target. The vulnerability was fixed by upstream Undertow in commits 5b008b7ac (JBEAP-9909) and 09d40a130 (UNDERTOW-1165), both of which shipped in the upstream 1.4.27.Final release before TuxCare onboarded it. The target contains all defensive mechanisms: RFC 7230 token validation for methods and headers, character whitelisting for request targets, rejection...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:d64c2aca-da5a-5639-9313-99c02c27c99b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:0df91c38-3800-5b65-bb91-a89e2fc2021c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 describes invalid characters being allowed in query strings and path parameters in Undertow versions before 1.4.17.Final. The target repository is running version 1.4.27.Final, which already contains the upstream vendor fix in commit 09d40a13089dbff37f8c76d20a41bf0d0e600d9d (UNDERTOW-1165, August 4, 2017). This fix adds character validation in HttpRequestParser that rejects invali...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:9af351ee-fad3-5d84-8efa-ac197cb398f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:d454c7dd-46f2-5424-a8fc-1120fd46bba5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:e1187790-77b0-5563-bba6-03e32452ef5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core, and is fixed in 1.4.27.Final-tuxcare.5." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:5432594b-efc0-5383-9ab6-1b7773831ebb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:21ba5ad0-abda-5b04-bde6-267c5e8ef273", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:34693efd-660b-5717-895b-4f9fee985581", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core, and is fixed in 1.4.27.Final-tuxcare.4." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:039462ee-c365-57e7-a427-059a687f62d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:42be1f44-f705-5399-ae04-4bf96910f865", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:8b2ae626-a52b-588a-94d8-fa1b67665ac1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:15303110-1510-5455-af97-8ecfd916489e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:ff52a0f1-a1bb-576d-a68c-07826b0a0b5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:e1871192-243e-5019-bb50-67f1cbd63020", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:e4f3910a-dab0-5d1d-9b71-32959259b8d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:e096713f-acf4-51d7-bb04-13d0e38ab578", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:2fe7c7e7-7a3e-5c25-a1ed-66d3245e5814", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:bbf27991-618c-57de-a4e3-040a6ba60305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:9bc7b199-c4f1-5d10-b69d-2457ddd14057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:acf73773-5ffd-515e-9134-7d906da86905", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:00b14e40-7ca7-5e24-b02b-74a783e2a8b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:87220f2f-98e8-5917-9994-3816c353e6c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:f77962af-b583-5dbf-a360-07b4398a9e84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core, and is fixed in 1.4.27.Final-tuxcare.6." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:1cb581e5-e5c1-5b53-994a-7dff68e2f288", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:b3a24ed9-c129-53dc-88b5-05baf4145cf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-1973 is fixed in version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:d227e5b9-4229-5fab-96fb-8234adfda1e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:3feec4a4-6100-54e6-9cfd-988b8895b4e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1459 is fixed in version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:a42a8182-9ef8-5fa7-8c1f-6393b00d9686", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:244c67d0-1fb9-51ac-90cf-aa07dc2ea317", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3653 is fixed in version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:da235951-b68c-552c-88d3-cab235420f66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:ce657050-6bab-5fa1-9182-1dfb191fbaf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core, and is fixed in 1.4.27.Final-tuxcare.4." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:e2249a25-c84d-5595-bc61-3ea518c4649c", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 1.4.27.Final-tuxcare.3." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:2cc6eb93-c5b0-5063-a8e3-98db03c9162b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-5971 is fixed in version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:b4befa00-168e-5e89-bdfc-9970e76498c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6162 is fixed in version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:befd379c-c3f5-5ea4-a303-06c20cd70c76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core, and is fixed in 1.4.27.Final-tuxcare.4." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:7fa55242-71e9-5437-826e-3a76bb4787e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:6d129697-9dbc-565b-8f28-14dd701ed712", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core, and is fixed in 1.4.27.Final-tuxcare.5." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:f5713970-9666-527a-bf90-72ddd98b2aa5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:c6ef4500-97ed-5284-bc01-f292315a4723", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:228a77ff-39f4-510c-a573-f413f2076016", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ], "bom-ref": "urn:uuid:ed6bedda-f189-5e8b-8bf5-405285edbdb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3260 is fixed in version 1.4.27.Final-tuxcare.3 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.3" } ] }