{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2fb98919-c597-543b-b50a-969e1a08048a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-parent",
      "purl": "pkg:maven/io.undertow/undertow-parent@2.3.20.Final-tuxcare.3",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-parent@2.3.20.Final-tuxcare.3",
      "version": "2.3.20.Final-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-parent",
            "purl": "pkg:maven/io.undertow/undertow-parent@2.3.20.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.20.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-3223",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.20.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4866c265-864b-5413-b2b4-ac8a018dbca4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-3223 does not affect version 2.3.20.Final-tuxcare.3 of io.undertow:undertow-parent. CVE-2023-3223 is not present in this target. The vulnerability allowed bypassing fileSizeThreshold limits by setting filename to null in multipart uploads, causing OutOfMemoryError. The upstream fix (commit 1f67f7a2f) added a fieldSizeThreshold that forces disk persistence even when filename is null. This fix was already included in the upstream Undertow 2.3.20.Final release before TuxCare onboarded it (onboarding commit 02d09c01a). The vulnerable pattern is absent because the upstream vendor shipped the fix in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.24.Final), NVD (< 2.2.24), Snyk (< 2.2.27.Final; >= 2.3.0.Alpha1, < 2.3.9.Final; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-28367",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.20.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:73df9b91-1418-57d6-b3bd-198ffb73176e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28367 affects version 2.3.20.Final-tuxcare.3 of io.undertow:undertow-parent."
      }
    },
    {
      "id": "CVE-2026-28368",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.20.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ef9dd421-8891-53f5-bf75-3be5a3db022c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-28368 does not affect version 2.3.20.Final-tuxcare.3 of io.undertow:undertow-parent. already_fixed \u2014 The target repository (Undertow 2.3.20.Final) already contains all defensive mechanisms required to prevent CVE-2026-28368 request smuggling attacks. The defenses were introduced through earlier backports (JBEAP-9909, UNDERTOW-1165, UNDERTOW-1774) and are functionally equivalent to the 2025 CVE patches, which primarily performed an architectural rewrite rather than introducing new security cont...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-28369",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.20.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:82557481-29bb-5f3d-8779-7ec7727d5eed",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-28369 does not affect version 2.3.20.Final-tuxcare.3 of io.undertow:undertow-parent. Patches already applied: 80b34f852a3fb8fc39309773cc739d05187381d8 (already in target via 3dea400a8c62 '[JBEAP-18580][UNDERTOW-1774] Treat whitespace as illegal in header field-name')",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-parent@2.3.20.Final-tuxcare.3"
    }
  ]
}