{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:839d8259-129b-5f40-afbf-95f6544cceef",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-core",
      "purl": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4",
      "version": "2.3.0.Final-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-core",
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.0.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.0.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-7816",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6287ba6d-b026-52e8-9bde-fb995aae1758",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-7816 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 (directory traversal via backslash in URLs on Windows) is NOT present in this target. The upstream fix (commit 28f244e63 by Stuart Douglas, dated Oct 28, 2014) was already included in the upstream 2.3.0.Final release that TuxCare onboarded. All defensive code is present: PathSeparatorHandler.java normalizes backslashes to forward slashes; ResourceHandler.java, DefaultServlet.java,...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-7046",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1fb68f0a-802c-5ac3-af39-585fc934ec24",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-7046 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 (BufferOverflowException from long URLs) is NOT present in Undertow 2.3.0.Final-tuxcare.3. The complete fix was already included in the upstream 2.3.0.Final release before TuxCare onboarded the project. All three affected files (HttpRequestConduit.java, HpackEncoder.java, ProxyHandler.java) contain the upstream fix that pre-validates request-line length and handles buffer overflow...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12165",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d02e8456-86ea-5e6f-a349-ac217dbb9c81",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12165 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.3.0.Final-tuxcare.3) is NOT AFFECTED by CVE-2017-12165. The vulnerability fix (commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f, JBEAP-9909) was already present in the upstream version 2.3.0.Final when TuxCare onboarded it. The fix was authored by Stuart Douglas (stuart.w.douglas@gmail.com) on 2017-03-30, nearly 9 years before TuxCare's onboarding on 2026-05-28....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12196",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a4d8e5d8-5350-5e62-9729-24a99a8217c7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12196 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 (Digest authentication URI validation bypass) is NOT present in target Undertow 2.3.0.Final. The vulnerability was fixed by upstream commits facb33a5c and 8804170ce (UNDERTOW-1190) authored by Stuart Douglas, which were already included in the upstream 2.3.0.Final release that TuxCare onboarded. The fix validates that the URI in the Digest Authorization header matches the HTTP re...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-2666",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a863c894-b270-58d6-9016-1ea8c93a9058",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-2666 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 is NOT present in this target. The vulnerability involved HTTP request smuggling via invalid characters in request lines and headers. All three upstream patches (5b008b7ac, 1e72647818, 3436b03eda) that fix this issue are present in the target's ancestry. The fix commit (3436b03eda) was authored by Stuart Douglas and is an ancestor of the first TuxCare commit (33c9b401 \"Onboard ver...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-2670",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3c9a37c4-c967-5761-a319-3d814bf9e175",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-2670 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. The target repository (Undertow 2.3.0.Final-tuxcare.3) is not affected by CVE-2017-2670. The vulnerability (WebSocket infinite loop on non-clean TCP close) was fixed in upstream Undertow 1.3.31.Final (June 2017) via commit 9bfe9fbbb. The fix adds a STATE_STREAM_BROKEN check to the do-while loop exit condition in AbstractFramedStreamSourceChannel.java, preventing infinite loops when streams break due to non-clean TCP closes. This fix was already present in the upstream 2.3.0.Final release that TuxCare onboarded, as confirmed by examining the onboarding commit (33c9b401). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7559",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d825c998-1ac8-55b5-b83b-4dabe0c7bae7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7559 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 is NOT present in Undertow 2.3.0.Final-tuxcare.3. The vulnerability concerns incomplete character validation in query strings and path parameters that could enable HTTP response manipulation attacks. The fix was implemented by upstream Undertow maintainer Stuart Douglas in commit 1e72647818 (March 30, 2017) and shipped in the upstream 2.3.0.Final release before TuxCare onboarded t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1114",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1826a0b7-78de-5412-ae76-e58a0f3dbba5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1114 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 is NOT present in the target. The vulnerability (file descriptor leak in URLResource.getLastModified() for jar protocol URLs) was fixed by upstream commit 882d5884f (UNDERTOW-1338) authored by Norito Agetsuma. This fix was already included in the upstream release 2.3.0.Final before TuxCare onboarded the project (commit 33c9b40117de). The target code at URLResource.java:92-98 conta...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-14642",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:78a2c7e3-d351-5b95-bb40-a65af4166132",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-14642 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 is not present in this target. The vulnerability involved writing full buffer contents (data.length) instead of only valid data (length+1) in HttpResponseConduit.java, causing information leakage from previous requests. The fix was authored by upstream maintainer Stuart Douglas in commit a83b047d5 (2018-09-13) and shipped in the upstream 2.3.0.Final release before TuxCare onboard...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-10212",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e4d55328-caa8-509d-b7e2-b643ccc9a704",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10212 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. CVE-2019-10212 affects Undertow versions under 2.0.20 where DEBUG logging in io.undertow.request.security exposed user credentials. The target version 2.3.0.Final-tuxcare.3 already contains upstream fixes (UNDERTOW-1515 and UNDERTOW-1576) that shipped in the upstream 2.3.0.Final release before TuxCare onboarding. These fixes removed credential logging from BasicAuthenticationMechanism debug statements and removed request/response headers from HttpServerExchange.toString(). Both fixes are authored by upstream developers (not TuxCare), confirming the vulnerable code pattern was never present in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-14888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e21efc55-b19c-51df-a3ce-3fd80cabd959",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14888 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. CVE-2019-14888 affected Undertow < 2.0.29 due to deadlocks in HTTPS processing. The target version (2.3.0.Final) contains upstream fixes that prevent these deadlocks. Although the original fix (846c50ead) from 2.0.29 was later reverted, alternative fixes addressing the same deadlock issues (UNDERTOW-1623, 1618, 1624) were applied by upstream developers and shipped in 2.3.0.Final. These fixes restructure locking to prevent threads from blocking indefinitely: queueFinalFrame() called outside synchronized blocks, STATE_READS_AWAKEN to prevent lost wakeups, and writeSucceeded tracking to prevent infinite loops. All fixes are upstream-authored (not TuxCare backports) and were already in the release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.29.Final), NVD (<= 2.0.28), cve.org (< 2.0.28.SP1), Snyk (< 2.0.29.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-3888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:97e62843-5388-5388-9f8a-234bb139d33a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3888 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. CVE-2019-3888 is not present in the target. The vulnerability involved credentials being exposed in log files when HttpServerExchange objects were logged at ERROR level, because the toString() method included request and response headers. The upstream fix (commit 20cacc96c, March 2019) removed headers from HttpServerExchange.toString(), and a complementary fix (commit 8b63e2585, October 2019) removed plaintext credentials from BasicAuthenticationMechanism debug logging. Both fixes were already present in the upstream Undertow 2.3.0.Final release (October 2022) that TuxCare onboarded. The target version 2.3.0.Final-tuxcare.3 contains the fixed code from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10687",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:41e6cc26-f8a5-5e0e-8cb4-5facbc3cbf1c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10687 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 does not affect this target. The vulnerability (HTTP request smuggling via invalid characters) was fixed in upstream Undertow 2.2.0.Final. The target version 2.3.0.Final was released after the fix and contains all required validation code. Both HTTP/1.x and HTTP/2 character validation mechanisms are present and enabled by default at HEAD (commit bd1c676ff).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10705",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e49f07f0-915c-5567-a80e-3c7368a61bda",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10705 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. CVE-2020-10705 affects Undertow versions before 2.1.1.Final. The target is Undertow 2.3.0.Final-tuxcare.3, which already contains the complete upstream fix (UNDERTOW-1657) that shipped in the 2.3.0.Final release. All four defense mechanisms from the vendor patches are present: (1) ResponseCommitListener forcing non-persistent connections when 100-continue isn't sent, (2) terminateRequestChannel() calls to prevent further buffer allocation, (3) freeContinueResponse() to release pooled buffers, and (4) extraBytes buffer cleanup for non-persistent exchanges. The fix was authored by Red Hat engineers and included in the upstream release before TuxCare onboarding. The vulnerable code pattern (unreleased buffers causing OOM) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10719",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7fe2f860-a17d-532e-af05-df2d5cbbb578",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10719 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 is NOT present in Undertow 2.3.0.Final. The vulnerability involved integer overflow in HTTP chunked transfer encoding chunk size parsing, which could enable request smuggling. The upstream vendor (Red Hat) fixed this in commit bfc8fbd67 by adding overflow validation before the left-shift operation in ChunkReader.java. This fix was already present in the upstream 2.3.0.Final relea...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1745",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6b912d98-26e4-5131-bb1d-ec2fb8e32eaa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1745 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. CVE-2020-1745 is not present in this target. The vulnerability was fixed in upstream Undertow by commit e60e04f4e (authored by mmiura@redhat.com from Red Hat), which added validation to reject unknown AJP request attributes unless they match a whitelist. This fix was already included in the upstream Undertow 2.3.0.Final release that TuxCare onboarded. The target code at core/src/main/java/io/undertow/server/protocol/ajp/AjpRequestParser.java:511-520 contains the complete fix: it validates attributes against ATTR_SET and only accepts unknown attributes matching allowedRequestAttributesPattern. Since the fix was authored by an upstream vendor (not TuxCare/CloudLinux) and was present in the upstream release before any TuxCare backports, the verdict is not_affected with justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1757",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:fd07bd4e-5acc-5c9d-9476-4670aeba0d25",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1757 affects version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-27782",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c34b97bc-3a61-56a1-8a6a-e72159113bfb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-27782 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. The target repository (Undertow 2.3.0.Final-tuxcare.3) is NOT AFFECTED by CVE-2020-27782. The vulnerability was fixed in the upstream Undertow project through two commits (UNDERTOW-1404 and UNDERTOW-1824/2060) that were already included in the 2.3.0.Final release before TuxCare onboarded it. The fixes catch IllegalArgumentException when parsing malformed AJP query strings and handle bad requests properly instead of causing abrupt connection closes. The vulnerable pattern is not present in the target because the upstream vendor's fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-20220",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b24cf093-5e69-5749-bc93-a1716d4c2951",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-20220 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.3.0.Final-tuxcare.3) is NOT vulnerable to CVE-2021-20220. The fix for this HTTP request smuggling vulnerability was already present in the upstream 2.3.0.Final release before TuxCare onboarded it. The fix, authored by Red Hat engineer Bartosz Spyrko-Smietanko (bspyrkos@redhat.com) in commit a18574a4d, adds character validation to HTTP/2 pseudo-headers (PATH, SC...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3597",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ec0ae5cc-105a-5372-bd7d-fb1dc92d591c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3597 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 is NOT present in this target. The vulnerability was fixed in upstream Undertow by commit b92904715 (authored by frainone@redhat.com) and shipped in the upstream 2.3.0.Final release (October 2022). TuxCare later onboarded this already-fixed version via commit 33c9b40117 (December 2023). The fix ensures that when flushComplete() is called with remaining header data and a final fram...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3629",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:8109bf04-e02d-52ad-82c3-328bb75621e2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3629 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3629 is not present in this target. The vulnerability (HTTP/2 flow control DoS via indefinite blocking) was fixed in upstream Undertow by commit a4e7b1dbd (UNDERTOW-1910), authored by frainone@redhat.com. This fix was already included in the upstream 2.3.0.Final release that TuxCare onboarded. All defensive mechanisms are present: bounded timeout (600s default) in AbstractFramedStreamS...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3690",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:05f9418c-dabe-508f-8986-230ba478c0c6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3690 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. CVE-2021-3690 is not present in target Undertow 2.3.0.Final-tuxcare.3. The vulnerability was a buffer leak on incoming WebSocket PONG messages when no handler was registered. The fix (commit c7e84a0b7) adds explicit buffer cleanup in the else branch of onFullPongMessage(). This fix was already present in the upstream release 2.3.0.Final that TuxCare onboarded, authored by Andrey Marinchuk (radist.nt@gmail.com). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3859",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d2897b74-cbae-5d9a-87b6-e5a3d7703f49",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3859 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. CVE-2021-3859 is not present in this target. The vulnerability involved HTTP/2 continuation frames not being consumed from the receive buffer, causing client-side timeouts and DoS. The fix (commit e43f0ada3f4da6e8579e0020cec3cb1a81e487c2) was already present in the upstream Undertow 2.3.0.Final release before TuxCare onboarding. The target code at Http2Channel.java:564-572 implements the do-while loop that consumes continuation frames from the buffer, preventing the timeout condition. This is an upstream fix by Red Hat, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-1259",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:23127dde-282b-56f7-829c-e7b6ca2feede",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-1259 affects version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2022-1319",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:5de6490a-8c08-5d59-a3b4-4379174218fb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-1319 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. already_fixed \u2014 CVE-2022-1319 (UNDERTOW-2060) has been fixed in the target repository. The fix commit eefae287893fc79736c9573975a9c96c3161cab0 from April 8, 2022 is present and contains both required defense mechanisms: (1) END_RESPONSE reuse flag changed from 1 to 0 to signal connection non-reusability after errors, and (2) removal of duplicate handleBadRequest() call to prevent sending two response packets.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-2053",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c203a3b4-ca93-5d59-83f9-b00510ab3826",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-2053 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. already_fixed \u2014 CVE-2022-2053 has already been fixed in the target repository. The fix (UNDERTOW-2133) was backported to all tuxcare-current branches. The code at AjpServerRequestConduit.java:206-207 contains the specific exception handler that catches RequestTooBigException and re-throws it, preventing the generic exception handler from silently closing the connection. This allows upper layers to send proper ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-2764",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:750b67fd-8d09-5db7-ad49-853b6eaf59a4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-2764 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core. already_fixed \u2014 CVE-2022-2764 (UNDERTOW-2048) has already been fixed in the target repository. The fix was applied via commits 5f3b1f269, 05ab8777e, and f60972d29 on the master branch, implementing timeout protection for blocking read operations in UndertowInputStream.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-4492",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4ec5aa39-2dfe-52f9-887e-0ed3c59df124",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-4492 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-1108",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f0521a7a-527e-59c2-95eb-f8f5dd8c72ec",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-1108 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-1973",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:2143d0d3-1b6a-5f47-a328-34ae7102a107",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-4639",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f7caafeb-a9bb-57fa-9470-6a9ef3459173",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-1459",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:549059d4-7eaa-5c21-b7cd-af68b7a7c361",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-1635",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a415b209-87f4-54ef-b22c-b1f4ecd5268b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-3653",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e4132e7d-1729-5f04-91f9-1c6e67fd73e9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-3884",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:197e0c3d-3c3d-5d12-9cf6-d7eff82ea83f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-3884 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4027",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b57e50ca-2170-5c36-8486-9402e785290f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4109",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1a5ddd5a-c239-55f5-b1eb-f01ca7ec50d7",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.3.0.Final-tuxcare.4."
      }
    },
    {
      "id": "CVE-2024-5971",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3e086555-8dfe-5d14-ab8b-48373223b643",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-6162",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7345609d-1c56-54be-b843-0c6f66d6ba10",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-6162 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-7885",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d36af053-83f4-57c5-9eaa-ff36e51cbbc8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-12543",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:2ac5378c-dd09-553d-b47f-320222df4214",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-9784",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:12ac94bd-c2d6-5aa2-96b3-404904347336",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28367",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6ad571f6-27b2-56b0-a66f-f7c03bc3c44b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28367 affects version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28368",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c5b012f6-be51-55ba-9946-95e987c120e2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28368 affects version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28369",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:5f80a4b2-59a3-547a-9a93-993cba49b42b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28369 affects version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-3260",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7ccd46de-ccc5-563c-8795-3ce0676d5d58",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-3260 affects version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-core@2.3.0.Final-tuxcare.4"
    }
  ]
}