{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:094a66b0-59fc-5059-9eed-92bf6fe94ec1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-parent",
      "purl": "pkg:maven/io.undertow/undertow-parent@2.3.24.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-parent@2.3.24.Final-tuxcare.1",
      "version": "2.3.24.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-parent",
            "purl": "pkg:maven/io.undertow/undertow-parent@2.3.24.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.24.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-3223",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e7afc36b-55f2-5834-a30b-d074420ed577",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-3223 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parent. The target repository (Undertow 2.3.24.Final-tuxcare.1) is NOT AFFECTED by CVE-2023-3223. The vulnerability fix was authored by upstream developers (Lin Gao <aoingl@gmail.com>, committed by Flavia Rainone <frainone@redhat.com>) and shipped in upstream version 2.3.24.Final, which TuxCare subsequently onboarded. The fix is present in the target at commit 1f67f7a2f and includes the defensive logic to persist large multipart content to disk even when the filename parameter is null, preventing the memory exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.24.Final), NVD (< 2.2.24), Snyk (< 2.2.27.Final; >= 2.3.0.Alpha1, < 2.3.9.Final; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-28367",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:07ade702-f05f-59ea-9674-9e0f26f0e54e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28367 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parent."
      }
    },
    {
      "id": "CVE-2026-28368",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d8a085b9-c3dd-5e7f-aaa2-b434714385c1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28368 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parent."
      }
    },
    {
      "id": "CVE-2026-28369",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-parent@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:48e44a96-7449-51b6-806e-68abb096ecb6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28369 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parent."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-parent@2.3.24.Final-tuxcare.1"
    }
  ]
}