{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:72a8f1bb-029d-57c1-a17a-fadcc678d593",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-core",
      "purl": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2",
      "version": "2.2.24.Final-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-core",
            "purl": "pkg:maven/io.undertow/undertow-core@2.2.24.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.2.24.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-7816",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:37f1cd54-97fe-5e2a-a0b9-46d95139d43b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-7816 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 is not present in Undertow 2.2.24.Final. The vulnerability was fixed by upstream commit 28f244e63 (UNDERTOW-338) authored by Stuart Douglas, which shipped in upstream release 2.2.24.Final before TuxCare onboarding (commit 7f3aff385). The fix prevents directory traversal on Windows by blocking or sanitizing URLs containing backslash characters. All defense code is present and activ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-7046",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3af8b1c5-4d4a-5e37-a3c5-2843cc16bc5b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-7046 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 (BufferOverflowException on long URLs) is not present in target version 2.2.24.Final-tuxcare.1. The fix for UNDERTOW-835 was already included in the upstream Undertow 2.2.24.Final release before TuxCare onboarded it. All three components of the fix are present in the target code: buffer capacity checking with STATE_URL state in HttpRequestConduit.java, overflow buffer mechanism in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12165",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:15c6fbe9-a436-551f-822f-e761a9311389",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12165 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.2.24.Final already contains the complete fix for CVE-2017-12165. The fix was authored by Stuart Douglas (upstream Undertow developer) on March 30, 2017, and was already present in the upstream Undertow 2.2.24.Final release that TuxCare onboarded on July 26, 2026. The vulnerable code pattern is not present in the target because all required validation mechanisms are in plac...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12196",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1ea9b222-58e2-5190-8381-6c9983df5773",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12196 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is not present in Undertow 2.2.24.Final. The vulnerability (URI validation bypass in Digest authentication) was fixed by upstream commit facb33a5c on 2017-10-03, and this fix was already included in the upstream release 2.2.24.Final when TuxCare onboarded it. The target contains the complete URI validation logic that prevents the attack described in the CVE.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-2666",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2a64fedb-a8fa-55da-ad47-48688d5d8710",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-2666 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 is not present in Undertow 2.2.24.Final. The vulnerability allowed HTTP request smuggling via invalid characters in request lines and headers. The upstream vendor (Stuart Douglas) fixed this in commits 1e7264781 (JBEAP-9909) and 3436b03ed (UNDERTOW-1165), which shipped in the upstream 2.2.24.Final release. TuxCare onboarded this release with the fixes already present. All three de...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-2670",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f0184a05-0a76-51cf-a60a-2386ccb713b0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-2670 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2017-2670 affects Undertow versions before 1.3.28, causing infinite loops on non-clean TCP close in WebSocket connections. The target version 2.2.24.Final already contains the upstream fix (commit 9bfe9fbbb) that adds STATE_STREAM_BROKEN to the loop exit condition. This fix was shipped in the upstream release before TuxCare onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7559",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4309ef51-b2ff-580c-9892-1cc3e5e0621a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7559 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 is NOT present in Undertow 2.2.24.Final. The vulnerability involved invalid characters being allowed in query strings and path parameters, enabling HTTP response manipulation. The target contains comprehensive character validation (via ALLOWED_TARGET_CHARACTER array and validation checks in handlePath, handleQueryParameters, and handlePathParameters) that rejects invalid character...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1114",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c8d5faf4-463e-5440-b1e6-018c72e27ef8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1114 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.2.24.Final-tuxcare.1) is NOT vulnerable to CVE-2018-1114. The file descriptor leak vulnerability in URLResource.getLastModified() for JAR URLs was already fixed in the upstream release 2.2.24.Final that TuxCare onboarded. The fix commit (882d5884f) by Norito Agetsuma was part of the upstream release and properly handles JAR URLs by using File.lastModified() ins...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-14642",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:30aa8910-271b-5fb1-84d9-1d32b6217c13",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-14642 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 is NOT present in this target. The fix (UNDERTOW-1412) was already included in upstream Undertow 2.2.24.Final before TuxCare onboarded it. The vulnerable pattern (writing data.length bytes from a reusable buffer potentially containing stale data) has been replaced with the correct implementation (writing only length+1 bytes of valid data). Fix commit a83b047d5 by Stuart Douglas (...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-10212",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6b84b38a-c8f9-56a1-bfaf-514427f74a89",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10212 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-10212 is NOT present in the target. The vulnerability involved credentials being exposed in DEBUG logs when io.undertow.request.security logging is enabled. The upstream Undertow project fixed this issue via two commits (UNDERTOW-1515 and UNDERTOW-1576) that removed sensitive data from debug output. Both fixes were already included in the upstream release 2.2.24.Final that TuxCare onboarded. Verified in source code: HttpServerExchange.toString() excludes headers (line 2539), and BasicAuthenticationMechanism debug logs exclude plainChallenge and base64Challenge (lines 154, 156).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-14888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:795eafb8-e728-5347-be00-1092f60f6ce3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-14888 affects version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2019-3888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ff29e6f4-a482-5c63-ba38-ed6b69888480",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3888 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-3888 is not present in Undertow 2.2.24.Final. The vulnerability involved information exposure of plain text credentials through log files when HttpServerExchange objects were logged. The upstream fix removed headers from HttpServerExchange.toString() and removed credential logging from BasicAuthenticationMechanism. Both fixes (commits 20cacc96c and 8b63e2585) were already included in upstream release 2.2.24.Final before TuxCare onboarded this version. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10687",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:662c83d0-8cc9-597b-83c9-533ac21b4460",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10687 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 is not present in the target. The vulnerability allowed HTTP request smuggling via invalid characters in request components (method, path, scheme, authority, header names), enabling cache poisoning, XSS, and cross-user information disclosure. The upstream Undertow project fixed this with commit a18574a4da (HTTP/2 validation, May 2020) and 3436b03eda (HTTP/1.x validation, Aug 2017...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10705",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bf9658e9-ee56-5d62-b8ed-20c168f33e54",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10705 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-10705 affects Undertow versions before 2.1.1.Final where certain requests with \"Expect: 100-continue\" header cause buffer leaks leading to OOM. The target version 2.2.24.Final already contains all UNDERTOW-1657 fixes (commits 64bbaeb7c, aa5e1fe11, b53d4589c) which shipped in the upstream 2.2.24.Final release before TuxCare onboarding. The vulnerable pattern is not present - all buffer cleanup, connection termination, and request channel management fixes are confirmed in the code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10719",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9f9caca8-b4b5-552d-8379-5724480f4c66",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10719 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 is not present in this target. The vulnerability involves integer overflow when parsing HTTP chunked transfer encoding chunk sizes, which could enable request smuggling attacks. The upstream vendor (Red Hat/JBoss) fixed this in commit bfc8fbd67 by adding bounds validation before left-shift operations in ChunkReader.java. This fix was already included in the upstream 2.2.24.Final ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1745",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2dcce622-8d71-5da8-b7fa-2f53714c043a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1745 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-1745 (AJP file inclusion vulnerability) is NOT present in Undertow 2.2.24.Final-tuxcare.1. The vulnerability affected Undertow versions \u22642.0.29.Final and was fixed in 2.0.30.Final by commit e60e04f4e (UNDERTOW-1667), which added validation to reject unknown AJP request attributes. This fix was authored by Masafumi Miura (mmiura@redhat.com) from Red Hat and was already part of the upstream Undertow 2.2.24.Final release that TuxCare onboarded (commit 7f3aff3854f by evasilev@cloudlinux.com). The target code at HEAD contains the complete fix: AjpRequestParser validates attribute names against a known-attribute whitelist (ATTR_SET) and only accepts unknown attributes matching an optional regex pattern (AJP_ALLOWED_REQUEST_ATTRIBUTES_PATTERN). By default (pattern=null), unknown attributes are silently dropped, preventing the file inclusion attack vector. All production code paths are protected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1757",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:17ac381c-8fa3-5209-a6d2-a7e4fe0ee388",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1757 affects version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-27782",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e108fe42-1ccb-5c7b-ac28-e95f12791bba",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-27782 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-27782 is not present in Undertow 2.2.24.Final. The vulnerability involved unhandled IllegalArgumentException when parsing malformed AJP query strings, causing denial of service. The upstream fixes (UNDERTOW-1404 and UNDERTOW-1824) were already included in version 2.2.24.Final before TuxCare onboarded it. The critical defense\u2014catching IllegalArgumentException during query string parsing\u2014is present at AjpRequestParser.java:462.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-20220",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:655817c9-4bda-5ab7-949f-8a054e23c796",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-20220 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. Version 2.2.24.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-qjwc-v72v-fq6r (affected below 2.1.6), NVD (affected below 2.1.6), CVE record (affected up to 2.2.0.Final), Snyk (affected below 2.1.6.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3597",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:943a7eab-6366-5e5f-a10c-18dab9ed80a4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3597 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 affects Undertow versions prior to 2.2.9.Final due to failure to write the final HTTP/2 frame under certain circumstances. The target version 2.2.24.Final is NOT affected because the upstream fix (commit b92904715, UNDERTOW-1842) was already present in the upstream 2.2.24.Final release when TuxCare onboarded it. The fix ensures that when flushComplete() encounters remaining unflus...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3629",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6b5003c3-32a6-5203-9e2d-f0651dc81ddd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3629 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3629 is not present in Undertow 2.2.24.Final. The vulnerability involves HTTP/2 flow control handling that could cause server threads to block indefinitely while waiting for WINDOW_UPDATE frames from the peer, leading to denial of service. The fix was introduced in upstream commit a4e7b1dbd (UNDERTOW-1910) by Flavia Rainone (frainone@redhat.com) and shipped in the upstream 2.2.24.Final...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3690",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:814da509-a523-5f97-9c08-137bb73a8dcc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3690 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2021-3690 is not present in Undertow 2.2.24.Final. The vulnerability involved a buffer leak in the WebSocket PONG message handler when no handler was registered. The fix (adding an else clause to free the buffer at line 156 of FrameHandler.java) was introduced by upstream commit c7e84a0b7efced38506d7d1dfea5902366973877, authored by Andrey Marinchuk (radist.nt@gmail.com) and merged before TuxCare's onboarding of version 2.2.24.Final. This is an upstream fix that shipped in the original Undertow 2.2.24.Final release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3859",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2f9179fb-d780-53a5-8011-bdbd93d29c6e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3859 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2021-3859 affects Undertow versions less than 2.2.15.Final due to incorrect HTTP/2 continuation frame handling causing timeouts and DoS. The target version 2.2.24.Final already contains the upstream fix (commit e43f0ada3) that was shipped in the original 2.2.24.Final release. Both fix components are present: (1) the do-while loop in Http2Channel.parseFrame() that consumes continuation frames immediately when buffered, and (2) the corrected iterator advancement in HpackEncoder that prevents header re-encoding on overflow. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-2053",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4b66e25b-b56d-51ee-99f9-245c770da417",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-2053 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2022-2053 is not present in Undertow 2.2.24.Final. The upstream vendor fix (commit 7d3a045da by Jason Lee) was already included in the 2.2.24.Final release that TuxCare onboarded. The fix adds a specific catch block for RequestTooBigException that re-throws it without calling IoUtils.safeClose(), allowing proper error handling upstream instead of silently closing the connection. Target version 2.2.24.Final is newer than the fixed version 2.2.19.Final mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-4492",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9c50cf0c-6521-5062-9b88-2887a10fcd30",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-4492 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2022-4492 is not present in Undertow 2.2.24.Final-tuxcare.1. The fix for missing hostname verification in HTTPS connections was already included in the upstream 2.2.24.Final release (commit a4d3b1671 by rmartinc@redhat.com) before TuxCare onboarded this version. The target code correctly sets ENDPOINT_IDENTIFICATION_ALGORITHM to \"HTTPS\" by default in both HTTP/1.1 and HTTP/2 client providers, enabling proper server identity verification during TLS handshake.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-1108",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:18e6c06c-5abe-5bd2-a108-edf05c45f6e6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-1108 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2023-1108 is NOT present in this target. The vulnerability (infinite loop in SslConduit.wrapAndFlip causing DoS) was fixed by upstream commit 1302c8cf4 authored by frainone@redhat.com, which was already included in Undertow version 2.2.24.Final before TuxCare's onboarding. The fix adds `&& !engine.isInboundDone()` to the while loop condition to prevent infinite looping when the SSL handshake status remains NEED_WRAP while the inbound connection is already closed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-1973",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:df53b8bc-1a82-5e2e-9b23-2107c185fcb6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-4639",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:95bba6b7-db67-5d1b-b303-4ee880e81661",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-1459",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9a91016a-8e72-5772-b85b-c82dce77e9d9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-1635",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:939bf191-c1bd-5c59-9583-945bebe53cb6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-3653",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5242a5c9-2ee5-5ecc-8bed-249822bb3644",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-3884",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:38d9594a-a764-55b0-bf46-b16f3f654f49",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-3884 affects version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4027",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0338ae2a-8aa4-5d08-b9ef-5033a9bdec98",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4109",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a440d58d-31b3-50b9-ac00-48ae728e7c44",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.2.24.Final-tuxcare.2."
      }
    },
    {
      "id": "CVE-2024-5971",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:741f673f-05d0-5556-aab9-6b667515027e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-6162",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e69a25ad-c290-5b44-bde5-eae442e53f35",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-6162 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-7885",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f4ad1c1c-fc1d-50fd-8099-8cc4ab672721",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-12543",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f0d518c8-eba6-5f34-91a3-0074445eed19",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-9784",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b78b9d6f-0b8f-5e3a-b05b-94c9d812ce0d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-9784 affects version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core, and is fixed in 2.2.24.Final-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-28367",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:859b0aad-aa61-50b5-ba9c-89df5c512194",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28367 affects version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28368",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e55cbc4e-a712-599d-9bd7-f265c7091a1c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28368 affects version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28369",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a1e1d030-0709-5fca-9a50-4df0d1af25bd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28369 affects version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-3260",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:67fcb96d-3ef6-5128-8f16-4ff9cbdb9d8f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-core@2.2.24.Final-tuxcare.2"
    }
  ]
}