{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9529c6d9-f864-5890-baff-2a0e7c091cf5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7", "version": "2.2.33.Final-tuxcare.7", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@2.2.33.Final", "type": "library", "group": "io.undertow", "version": "2.2.33.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:d17acf17-b31c-5747-b7e5-27df533485e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-7816 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.2.33.Final) is not affected by CVE-2014-7816. The vulnerability was fixed in upstream commit 28f244e63 (October 2014) which addresses directory traversal attacks on Windows by rejecting or sanitizing HTTP request paths containing backslash characters. This fix was already present in the upstream release that TuxCare onboarded. The defensive code is active in Re...", "justification": "code_not_present" } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:9d009f2a-b411-519b-b0f3-b26d8b413c9f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-7046 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 is NOT present in Undertow 2.2.33.Final-tuxcare.6. The vulnerability was fixed by upstream Undertow maintainers in September 2016 (commit c518b5a17 by Stuart Douglas), well before the 2.2.33.Final release. The target version contains the complete fix: HttpRequestConduit checks request line length before writing and uses incremental STATE_URL writing when the URL exceeds buffer cap...", "justification": "code_not_present" } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:568a3e05-4243-5432-ab15-086343afd200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12165 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12165 (HTTP request smuggling via unusual whitespace in headers) is NOT present in target version 2.2.33.Final. The upstream vendor fix from commit 1e72647 (March 2017) was already included in the upstream 2.2.33.Final release that TuxCare onboarded in October 2025. All required defenses are present and active: RFC 7230 token validation for headers/methods (Connectors.verifyToken), req...", "justification": "code_not_present" } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:45a88249-985c-5b3b-bb91-29cd27440b21", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 affects Undertow's Digest authentication where the server fails to validate that the URI in the Authorization header matches the actual HTTP request URI, enabling MITM attacks. The target version 2.2.33.Final-tuxcare.6 contains the complete fix (commits facb33a5c and 8804170ce) which validates URI matching for both relative and absolute URIs. Both fix commits were authored by Stu...", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:6d44974c-7600-5815-b67c-796728b8050c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2666 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 is NOT present in Undertow 2.2.33.Final-tuxcare.6. The upstream vendor (Stuart Douglas) applied comprehensive fixes in commits 1e72647 (2017-03-30, JBEAP-9909) and 3436b03 (2017-08-04, UNDERTOW-1165) that validate HTTP request syntax strictly per RFC7230. These fixes reject invalid characters in request tokens/targets and malformed separators, preventing HTTP smuggling attacks. Bo...", "justification": "code_not_present" } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:ff9dc631-a696-59fd-8fc1-373c8690fbef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-2670 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2017-2670 is NOT present in Undertow 2.2.33.Final-tuxcare.6. The vulnerability (infinite loop on non-clean TCP close in WebSocket) was fixed in upstream commit 9bfe9fbbb (UNDERTOW-1035) by adding STATE_STREAM_BROKEN check to the loop condition in AbstractFramedStreamSourceChannel.java. This fix shipped in the upstream release before TuxCare onboarding (commit 4571debb1). The target code contains the fix at line 301: `allAreClear(state, STATE_CLOSED | STATE_STREAM_BROKEN)`, which prevents the infinite loop when a stream is broken without formal close.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "code_not_present" } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:0882d933-94bd-53f8-a2db-491d0604fc9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7559 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 describes an incomplete fix for CVE-2017-2666, where invalid characters (CR, LF, control chars < 32) were still allowed in query strings and path parameters, enabling HTTP response injection attacks. The target version 2.2.33.Final is NOT AFFECTED. The vulnerability was fixed by upstream commit 3436b03ed (UNDERTOW-1165, Aug 2017), which added character validation to handleQueryPar...", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:8bd255d7-04f9-5651-b32a-53bafacc352e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-1114. The vulnerability (file descriptor leak in URLResource.getLastModified() for JAR URLs) was fixed in upstream commit 882d5884f authored by Norito Agetsuma. This fix was already present in the upstream 2.2.33.Final release that TuxCare onboarded. The vulnerable code pattern (calling connection.getLastModified() directly for jar:// URLs witho...", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:7b0d9156-9c84-55c1-92c2-0c65e730cf81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-14642 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 (information leak via buffer overflow in HTTP response writing) is NOT present in the target repository. The vulnerability involved writing the entire buffer array (data.length) instead of only the populated bytes (length + 1), causing data from previous requests to leak into the current response. The fix was applied by upstream author Stuart Douglas in commit a83b047d57 on 2018-...", "justification": "code_not_present" } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:a546d73f-06ab-5fde-b56e-05ec4a25aa58", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-10212 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2019-10212 is NOT present in Undertow 2.2.33.Final-tuxcare.6. The vulnerability (credential disclosure via DEBUG logging) was fixed by upstream commits 8b63e258502f (UNDERTOW-1576) and 20cacc96c059 (UNDERTOW-1515) that shipped in the upstream release before TuxCare onboarded this version. The fixes remove plaintext credentials, base64-encoded credentials, and Authorization headers from all DEBUG log output in BasicAuthenticationMechanism and HttpServerExchange.toString().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:402228e2-d3a7-56f8-a643-46c353e9ea94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-14888 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. Version 2.2.33.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vjxc-frw4-jmh5 (affected below 2.0.29.Final), NVD (affected up to 2.0.28), CVE record (affected below 2.0.28.SP1), Snyk (affected below 2.0.29.Final).", "justification": "code_not_present" } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:40cebca6-b4fb-5c67-8c57-47df62e94812", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3888 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2019-3888 affects Undertow versions before 2.0.21.Final. The target version 2.2.33.Final-tuxcare.6 contains the upstream fix (commit 20cacc96c by Carter Kozak, 2019-03-28) that removes request/response headers from HttpServerExchange.toString(), preventing credential exposure in logs. The fix was shipped in upstream release 2.0.20.Final before TuxCare onboarding, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:cee209c7-7769-585f-ba0e-eabecc2790cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10687 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 affects Undertow versions before 2.2.0.Final due to HTTP request smuggling through invalid character handling. The target is Undertow 2.2.33.Final, which includes all three upstream fixes (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) that address this CVE. The fixes validate HTTP request components against allowed-character arrays, reject control characters (tabs, newlines, CR) w...", "justification": "code_not_present" } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:01ac11fd-5f36-584b-80bb-5e74aefc7413", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10705 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2020-10705 is not present in Undertow 2.2.33.Final-tuxcare.6. All three upstream fix commits (64bbaeb7c, aa5e1fe11, b53d4589c) for UNDERTOW-1657 were already included in the upstream release 2.2.33.Final that TuxCare onboarded. The fixes, authored by Flavia Rainone (frainone@redhat.com) at Red Hat, properly address the buffer leak vulnerability by: (1) terminating requests when Expect:100-continue is rejected (EXPECTATION_FAILED status), (2) freeing pooled buffers via exchange completion listeners, (3) marking non-persistent connections when continue responses aren't sent, and (4) closing extra bytes buffers. Code inspection confirms all defensive measures are present and unreversed in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).", "justification": "code_not_present" } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:2235ce56-c7f8-5401-9260-f554ad168307", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-10719 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 is not present in the target. The vulnerability involved integer overflow when parsing HTTP chunked transfer-encoding chunk sizes, which could enable request smuggling. The upstream vendor (Red Hat) fixed this in commit bfc8fbd67 by adding a limit check (Long.MAX_VALUE >> 4) before chunk size accumulation. This fix was already present in the upstream release 2.2.33.Final that Tux...", "justification": "code_not_present" } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:edc26576-ecff-548a-bda1-aa9b8e5bf878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1745 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2020-1745 (AJP file inclusion via arbitrary request attributes) is NOT present in target version 2.2.33.Final-tuxcare.6. The vulnerability was fixed by upstream Undertow in commit e60e04f4e (UNDERTOW-1667) authored by mmiura@redhat.com, which added validation to reject unknown AJP attribute names unless they match a configured regex pattern. This fix was already present in the upstream 2.2.33.Final release before TuxCare onboarded it (first TuxCare commit: 4571debb1 \"ELSJAVA-769 Onboarding setup\"). The target code contains the complete defense: AjpRequestParser validates attribute names against ATTR_SET and only accepts unknown names matching allowedRequestAttributesPattern (default: null, rejecting all unknown attributes). The vulnerable pattern (unconditional acceptance of arbitrary attribute names) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).", "justification": "code_not_present" } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:9fd6a243-de39-553d-a124-7d166f2f28c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:44fb7b5c-aacc-5042-8f74-93b5bbac6344", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-27782 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. Target version 2.2.33.Final is not affected by CVE-2020-27782. Both required fixes (UNDERTOW-1404: catching IllegalArgumentException for invalid query strings, and UNDERTOW-1824: proper AJP error responses) were already present in the upstream 2.2.33.Final release (released 2024-08-14) that TuxCare onboarded. The CVE affects versions 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1, all older than 2.2.33.Final. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:8cce4be7-6712-556f-aada-295432f261d4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-20220 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 Target version 2.2.33.Final-tuxcare.6 is not affected by CVE-2021-20220. The vulnerability requires HTTP/2 pseudo-headers (:path, :scheme, :authority, :method) to accept invalid characters, enabling request smuggling attacks. The fix (commit a18574a4d from May 2020) adds byte-level validation for all HTTP/2 pseudo-headers and was already present in the upstream release 2.2.33.Final that TuxCare...", "justification": "code_not_present" } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:0386d5ea-80d0-5a16-b9a2-cb6e0a3f1bc3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3597 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 describes a denial of service vulnerability in Undertow where HTTP/2 final frames fail to be written under certain circumstances. The fix (UNDERTOW-1842) modifies AbstractFramedStreamSinkChannel.flushComplete() to requeue the final frame when flush completes with remaining body data. This fix is present in the target at commit b92904715c5f5857827cf4201b9bce5844919259, authored by ...", "justification": "code_not_present" } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:6dae4c6c-8306-5e75-926e-e92c1b08f11a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3629 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3629 (UNDERTOW-1910) affects Undertow versions prior to 2.0.40.Final and 2.2.11.Final due to infinite blocking in HTTP/2 flow control handling. The target repository at version 2.2.33.Final-tuxcare.6 already contains the upstream fix (commit a4e7b1dbd) that adds timeout protection to AbstractFramedStreamSinkChannel.awaitWritable(). The fix was authored by frainone@redhat.com and shippe...", "justification": "code_not_present" } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:4ced88f8-a110-5272-91c8-1855123869e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3690 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2021-3690 (buffer leak on WebSocket PONG messages) is NOT present in Undertow 2.2.33.Final. The fix was already included in the upstream release that TuxCare onboarded. The vulnerable code pattern (missing buffer free in the else branch) has been patched - the target contains the defensive else block at FrameHandler.java:155-157 that properly releases buffers when no PONG message handler is registered, preventing memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).", "justification": "code_not_present" } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:53f83fbb-210e-56c0-9a35-ee427335ba42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-3859 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2021-3859 affects Undertow versions before 2.2.15.Final due to improper handling of HTTP/2 continuation frames. The target version 2.2.33.Final contains the upstream fix (commit e43f0ada3) that was released in version 2.2.15.Final on September 16, 2021. The fix was authored by rmartinc@redhat.com and shipped in the upstream release that TuxCare later onboarded. The vulnerable code pattern (missing continuation frame loop in parseFrame() and incorrect iterator advancement in HpackEncoder) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:a929bbcb-9074-5243-af35-7b58e40a3c16", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-2053 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2022-2053: Target version 2.2.33.Final-tuxcare.6 is NOT AFFECTED. The vulnerability (premature connection closure when POST request exceeds max-post-size, causing proxy to mark backend as failed) was fixed in upstream Undertow by commit 7d3a045da (author: Jason Lee , July 25, 2022). This fix was already present in the upstream release that TuxCare onboarded (first TuxCare commit 4571debb1 \"ELSJAVA-769 Onboarding setup\" by ssaprikin@cloudlinux.com). The fix adds a specific catch block for RequestTooBigException at AjpServerRequestConduit.java:206-207, allowing the exception to propagate to higher layers for proper error response generation, instead of prematurely closing the connection at the conduit level.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2).", "justification": "code_not_present" } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:e6b5bc1a-757e-591c-9270-4ebdfd7d1e5f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-4492 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2022-4492 is not present in undertow 2.2.33.Final. The vulnerability concerned missing hostname verification in HTTPS/HTTP2 client connections. The upstream fix (commit a4d3b1671) was included in upstream release 2.2.24.Final, which predates the target version 2.2.33.Final. The fix sets ENDPOINT_IDENTIFICATION_ALGORITHM to \"HTTPS\" by default, enabling hostname verification during TLS handshakes. All affected components (HttpClientProvider, Http2ClientProvider, UndertowXnioSsl) contain the complete fix implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:b519ae0d-5c96-5ae7-aacb-f84ca402e0ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-1108 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2023-1108 - Target is NOT AFFECTED. The vulnerability (infinite loop in SslConduit.wrapAndFlip due to missing isInboundDone() check) was fixed in upstream commit 1302c8cf4 by Red Hat on 2023-02-28, included in release 2.2.24.Final. TuxCare onboarded version 2.2.33.Final on 2025-10-29, which already contained this upstream fix. The vulnerable code pattern is not present in HEAD (258ca36f). Lines 1005-1006 of SslConduit.java show the fix: the while loop condition includes '&& !engine.isInboundDone()' preventing infinite loops when inbound processing completes while handshake status is NEED_WRAP.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:f7b3efbe-b4fa-5b6a-b426-24b4097e5cc8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-1973 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2023-1973 is NOT present in the target. The vulnerability (memory exhaustion via long-lived unauthenticated sessions) was already fixed in the upstream 2.2.33.Final release before TuxCare onboarded this version. Both affected files contain the upstream fix: session timeout is limited to 120 seconds for sessions created during form authentication, preventing accumulation of long-lived session objects. The fix commits (b289b18bc0 from 2024-01-19 and follow-up 04234f492 from 2024-04-23) by Richard Op\u00e1lka are ancestors of the TuxCare onboarding commit (4571debb1), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final), Snyk (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final).", "justification": "code_not_present" } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:caec0321-ab03-51c6-9fc5-afc277b55183", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-4639 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2023-4639 is NOT present in the target repository. The vulnerability involved incorrect cookie parsing where a quoted cookie value without a closing double-quote before a semicolon/comma delimiter would cause the parser to remain in quoted-value state and consume subsequent cookies as part of the malformed cookie value, enabling cookie spoofing or exfiltration. The fix (lines 319-322 in Cookies.java) that resets parser state when encountering delimiters in quoted values was already present in the upstream 2.2.33.Final release before TuxCare onboarded it (commit ea7ea2525 by baranowb@gmail.com, ancestor of first TuxCare commit 4571debb1). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.11.Final; < 2.2.30.Final), Snyk (< 2.2.30.Final; >= 2.3.0.Alpha1, < 2.3.11.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:1540b618-0300-5ad7-8455-b143b2841234", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1459 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.2.33.Final) is NOT affected by CVE-2024-1459. The upstream fix for this path traversal vulnerability (commit 40bb3314f013247af8e222870bd5045ca8650c5c) was already present in the upstream release version 2.2.33.Final when TuxCare onboarded it. The fix prevents the malicious sequence \"/..;/\" from being treated as a parent directory traversal operator by preservin...", "justification": "code_not_present" } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:4e979c02-3d9b-518b-bf8e-bc971b119d3b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1635 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. The target repository (Undertow 2.2.33.Final-tuxcare.6) is NOT affected by CVE-2024-1635. The vulnerability pattern (missing close listener in WriteTimeoutStreamSinkConduit that causes timeout handle leaks) is absent from the target code. The fix was introduced in upstream commit e824766df3b9d9614eff7700159e3aac5a35a1b8 by Red Hat engineer Flavia Rainone (frainone@redhat.com) and was already present in the upstream release 2.2.33.Final before TuxCare's onboarding. The target code contains the complete fix: a close listener registered in the constructor that removes timeout handles when connections close, volatile handle field, and synchronized cleanup operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Final, < 2.3.12.Final; < 2.2.31.Final), cve.org (= 1.31.0), Snyk (< 2.2.31.Final; >= 2.3.0.Final, < 2.3.12.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:80fe3273-9f3f-5a97-a666-ab14ba2b85c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:82d76bc2-ca59-55ef-be9c-6cb057fafc98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:f86c0834-0b7d-5c84-a61e-120c8a812f51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:39a510fa-f571-5bdc-a92f-89a4a4a4348e", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.2.33.Final-tuxcare.7." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:2709271d-d9d2-5f98-afc4-15432ef85a65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:a837ab93-b30a-5194-aaf5-ed5aa1b82eda", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6162 does not affect version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core. CVE-2024-6162 is not present in Undertow 2.2.33.Final-tuxcare.6. The vulnerability involved a shared StringBuilder instance field (decodeBuffer) being reused across multiple URL decode operations in the AJP parser, causing path data to mix between concurrent requests. The upstream fix (commit a28ac53076 by thofman@redhat.com, Nov 2023) removed the instance field and created a new local StringBuilder for each decode operation. This fix was already present in the upstream Undertow 2.2.33.Final release that TuxCare onboarded in Oct 2025, nearly 2 years after the upstream fix. The vulnerable code pattern (shared mutable buffer) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.14.Final; < 2.2.33.Final), cve.org (< 2.2.33.Final; >= 2.3.0.Alpha1, < 2.3.14), Snyk (< 2.2.33.Final; >= 2.3.0.Final, < 2.3.14.Final).", "justification": "code_not_present" } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:d07003ad-3768-56f3-b366-97667fceb22f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:16f28c69-197e-5fad-8ee8-5ed1ecce082d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:e766e3f6-8110-5555-9841-736c7232d951", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:e9f39d03-987f-5df3-87e1-493fb03d4321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:320ffa90-8224-5202-8745-ecdc43d0364a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:e5dd0fd7-c249-5de9-b2f9-458d5a8b308c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ], "bom-ref": "urn:uuid:45070f95-462c-52a5-8c79-d9a48571054b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.2.33.Final-tuxcare.7 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@2.2.33.Final-tuxcare.7" } ] }