{ "@id": "urn:uuid:9c529f1b-ad5b-48aa-b985-609f2147c519", "role": "Document Creator", "author": "https://tuxcare.com", "version": 45, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T17:48:33.516993+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T04:47:00.593938+00:00", "status_notes": "Vulnerability CVE-2014-7816 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 is NOT present in Undertow 2.3.17.Final. The vulnerability was fixed by upstream maintainer Stuart Douglas in October 2014 (commit 28f244e63). The fix adds multiple defenses against directory traversal on Windows: PathSeparatorHandler normalizes backslash separators to forward slash, and ResourceHandler/DefaultServlet/ServletPathMatches reject resource paths containing File.separa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-7816" }, "impact_statement": "not_affected \u2014 CVE-2014-7816 is NOT present in Undertow 2.3.17.Final. The vulnerability was fixed by upstream maintainer Stuart Douglas in October 2014 (commit 28f244e63). The fix adds multiple defenses against directory traversal on Windows: PathSeparatorHandler normalizes backslash separators to forward slash, and ResourceHandler/DefaultServlet/ServletPathMatches reject resource paths containing File.separa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T04:00:49.130738+00:00", "status_notes": "Vulnerability CVE-2016-7046 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 is not present in this target. The vulnerability (BufferOverflowException from long URLs in proxy requests) was fixed in upstream commit c518b5a1784061d807efedcef0a03fcd35a53de2 (UNDERTOW-835) by Stuart Douglas, which was already included in the upstream 2.3.17.Final release before TuxCare onboarded it. All three defensive mechanisms from the vendor patches are present in HEAD: (1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-7046" }, "impact_statement": "not_affected \u2014 CVE-2016-7046 is not present in this target. The vulnerability (BufferOverflowException from long URLs in proxy requests) was fixed in upstream commit c518b5a1784061d807efedcef0a03fcd35a53de2 (UNDERTOW-835) by Stuart Douglas, which was already included in the upstream 2.3.17.Final release before TuxCare onboarded it. All three defensive mechanisms from the vendor patches are present in HEAD: (1..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T03:57:59.975111+00:00", "status_notes": "Vulnerability CVE-2017-12165 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12165 is NOT present in target version 2.3.17.Final. The upstream vendor fix (commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f by Stuart Douglas, Red Hat) was already included in the Undertow 2.3.17.Final release that TuxCare onboarded. The fix adds comprehensive validation across all protocols (HTTP/1.1, HTTP/2, AJP) to reject requests with: (1) invalid RFC 7230 token characters in hea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12165" }, "impact_statement": "not_affected \u2014 CVE-2017-12165 is NOT present in target version 2.3.17.Final. The upstream vendor fix (commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f by Stuart Douglas, Red Hat) was already included in the Undertow 2.3.17.Final release that TuxCare onboarded. The fix adds comprehensive validation across all protocols (HTTP/1.1, HTTP/2, AJP) to reject requests with: (1) invalid RFC 7230 token characters in hea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T23:46:00.189485+00:00", "status_notes": "Vulnerability CVE-2017-12196 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 Target is not affected by CVE-2017-12196. The vulnerability involved missing URI validation in Undertow's Digest authentication mechanism, allowing attackers to authenticate for one URI while accessing another (MITM attack). The fix, which validates that the digest-uri field in the Authorization header matches the actual HTTP request URI, was implemented by upstream Undertow developer Stuart Do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12196" }, "impact_statement": "not_affected \u2014 Target is not affected by CVE-2017-12196. The vulnerability involved missing URI validation in Undertow's Digest authentication mechanism, allowing attackers to authenticate for one URI while accessing another (MITM attack). The fix, which validates that the digest-uri field in the Authorization header matches the actual HTTP request URI, was implemented by upstream Undertow developer Stuart Do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T04:28:00.102165+00:00", "status_notes": "Vulnerability CVE-2017-2666 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 describes an HTTP request smuggling vulnerability where Undertow's HTTP parser permitted invalid characters in request lines, enabling response manipulation through proxy interpretation differences. The target version 2.3.17.Final already contains the complete upstream fix (commit 3436b03ed by Stuart Douglas) that validates all HTTP tokens against RFC7230, rejects invalid/control ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-2666" }, "impact_statement": "not_affected \u2014 CVE-2017-2666 describes an HTTP request smuggling vulnerability where Undertow's HTTP parser permitted invalid characters in request lines, enabling response manipulation through proxy interpretation differences. The target version 2.3.17.Final already contains the complete upstream fix (commit 3436b03ed by Stuart Douglas) that validates all HTTP tokens against RFC7230, rejects invalid/control ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2017-2670 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2017-2670 is not present in target version 2.3.17.Final. The vulnerability (infinite loop on IO threads due to non-clean WebSocket TCP close) was fixed upstream by commit 9bfe9fbbb on June 13, 2017. This fix was already included in the 2.3.17.Final release that TuxCare onboarded. The vulnerable code pattern (loop checking only STATE_CLOSED) is not present; the target code correctly checks both STATE_CLOSED and STATE_STREAM_BROKEN at line 301 of AbstractFramedStreamSourceChannel.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-2670" }, "impact_statement": "CVE-2017-2670 is not present in target version 2.3.17.Final. The vulnerability (infinite loop on IO threads due to non-clean WebSocket TCP close) was fixed upstream by commit 9bfe9fbbb on June 13, 2017. This fix was already included in the 2.3.17.Final release that TuxCare onboarded. The vulnerable code pattern (loop checking only STATE_CLOSED) is not present; the target code correctly checks both STATE_CLOSED and STATE_STREAM_BROKEN at line 301 of AbstractFramedStreamSourceChannel.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T18:39:51.742680+00:00", "status_notes": "Vulnerability CVE-2017-7559 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 affects Undertow 2.x before 2.0.0.Alpha2. The target version is 2.3.17.Final, which is significantly newer than the fixed version. The vulnerability allowed invalid characters in query strings and path parameters, enabling HTTP response manipulation. The fix (commit d63b76701, UNDERTOW-1185, November 2017) added character validation that rejects control characters, non-ASCII chara...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7559" }, "impact_statement": "not_affected \u2014 CVE-2017-7559 affects Undertow 2.x before 2.0.0.Alpha2. The target version is 2.3.17.Final, which is significantly newer than the fixed version. The vulnerability allowed invalid characters in query strings and path parameters, enabling HTTP response manipulation. The fix (commit d63b76701, UNDERTOW-1185, November 2017) added character validation that rejects control characters, non-ASCII chara..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T00:19:00.148698+00:00", "status_notes": "Vulnerability CVE-2018-1114 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 (file descriptor leak in URLResource.getLastModified() for jar URLs) does not affect target version 2.3.17.Final. The upstream fix (commit 882d5884f by Norito Agetsuma) was already present in upstream Undertow 2.3.17.Final before TuxCare onboarded it. The fix adds special handling for jar protocol URLs to avoid calling JarURLConnection.getLastModified(), which leaks file descripto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1114" }, "impact_statement": "not_affected \u2014 CVE-2018-1114 (file descriptor leak in URLResource.getLastModified() for jar URLs) does not affect target version 2.3.17.Final. The upstream fix (commit 882d5884f by Norito Agetsuma) was already present in upstream Undertow 2.3.17.Final before TuxCare onboarded it. The fix adds special handling for jar protocol URLs to avoid calling JarURLConnection.getLastModified(), which leaks file descripto..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T04:16:00.095486+00:00", "status_notes": "Vulnerability CVE-2018-14642 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 (information leak via buffer over-write) is NOT present in target version 2.3.17.Final. The vulnerable code pattern was fixed by upstream commit a83b047d5 (Stuart Douglas, 2018-09-13) which changed `next.write(data, 0, data.length)` to `next.write(data, 0, length + 1)` in HttpResponseConduit.java line 157, limiting writes to populated buffer elements only. This fix was included i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14642" }, "impact_statement": "not_affected \u2014 CVE-2018-14642 (information leak via buffer over-write) is NOT present in target version 2.3.17.Final. The vulnerable code pattern was fixed by upstream commit a83b047d5 (Stuart Douglas, 2018-09-13) which changed `next.write(data, 0, data.length)` to `next.write(data, 0, length + 1)` in HttpResponseConduit.java line 157, limiting writes to populated buffer elements only. This fix was included i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:54:30.943101+00:00", "status_notes": "Vulnerability CVE-2019-10212 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. Target version 2.3.17.Final is not affected by CVE-2019-10212. The vulnerability pattern (credential logging in debug statements) is not present because upstream fixes were already included in the upstream release before TuxCare onboarding. Two commits address the issue: (1) 8b63e258 removes plainChallenge and base64Challenge from BasicAuthenticationMechanism debug logs, and (2) 20cacc96c removes headers from HttpServerExchange.toString(). Both fixes were authored by upstream contributors (pjindal@pjindal.pnq.csb and ckozak@ckozak.net) and were present before the first TuxCare commit (2a4e13f45 - onboarding of 2.3.17.Final).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10212" }, "impact_statement": "Target version 2.3.17.Final is not affected by CVE-2019-10212. The vulnerability pattern (credential logging in debug statements) is not present because upstream fixes were already included in the upstream release before TuxCare onboarding. Two commits address the issue: (1) 8b63e258 removes plainChallenge and base64Challenge from BasicAuthenticationMechanism debug logs, and (2) 20cacc96c removes headers from HttpServerExchange.toString(). Both fixes were authored by upstream contributors (pjindal@pjindal.pnq.csb and ckozak@ckozak.net) and were present before the first TuxCare commit (2a4e13f45 - onboarding of 2.3.17.Final).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:30:34.591989+00:00", "status_notes": "Vulnerability CVE-2019-14888 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-14888 affects Undertow versions before 2.0.29 due to deadlocks in HTTPS handling. The target version 2.3.17.Final already contains all upstream fixes that prevent these deadlocks. The vulnerability involved synchronized blocks in AbstractFramedChannel.receive() and related methods causing threads to deadlock when processing HTTPS traffic. Upstream developers addressed this through multiple commits (UNDERTOW-1623, 1618, 1624) that moved lock-sensitive operations outside synchronized blocks, added state management for read awakening, and prevented infinite loops. All fixes were present in upstream version 2.3.17.Final when TuxCare onboarded it, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.29.Final), NVD (<= 2.0.28), cve.org (< 2.0.28.SP1), Snyk (< 2.0.29.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14888" }, "impact_statement": "CVE-2019-14888 affects Undertow versions before 2.0.29 due to deadlocks in HTTPS handling. The target version 2.3.17.Final already contains all upstream fixes that prevent these deadlocks. The vulnerability involved synchronized blocks in AbstractFramedChannel.receive() and related methods causing threads to deadlock when processing HTTPS traffic. Upstream developers addressed this through multiple commits (UNDERTOW-1623, 1618, 1624) that moved lock-sensitive operations outside synchronized blocks, added state management for read awakening, and prevented infinite loops. All fixes were present in upstream version 2.3.17.Final when TuxCare onboarded it, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.29.Final), NVD (<= 2.0.28), cve.org (< 2.0.28.SP1), Snyk (< 2.0.29.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:16:16.415526+00:00", "status_notes": "Vulnerability CVE-2019-3888 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-3888 describes credential exposure through error logging when Connectors.executeRootHandler logs HttpServerExchange objects containing request/response headers with authentication credentials. The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT affected because the upstream vendor fixes were already present in the 2.3.17.Final release that TuxCare onboarded. Two upstream commits removed the vulnerability: (1) commit 20cacc96c (March 2019) removed headers from HttpServerExchange.toString() output, and (2) commit 8b63e2585 (October 2019) removed plaintext credentials from BasicAuthenticationMechanism debug logging. Both commits are ancestors of the TuxCare onboarding commit 2a4e13f4599cac4a7a0eee712e65ea384c59661b and were authored by non-TuxCare developers (Carter Kozak and Paramvir Jindal). The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-3888" }, "impact_statement": "CVE-2019-3888 describes credential exposure through error logging when Connectors.executeRootHandler logs HttpServerExchange objects containing request/response headers with authentication credentials. The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT affected because the upstream vendor fixes were already present in the 2.3.17.Final release that TuxCare onboarded. Two upstream commits removed the vulnerability: (1) commit 20cacc96c (March 2019) removed headers from HttpServerExchange.toString() output, and (2) commit 8b63e2585 (October 2019) removed plaintext credentials from BasicAuthenticationMechanism debug logging. Both commits are ancestors of the TuxCare onboarding commit 2a4e13f4599cac4a7a0eee712e65ea384c59661b and were authored by non-TuxCare developers (Carter Kozak and Paramvir Jindal). The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T03:26:00.144839+00:00", "status_notes": "Vulnerability CVE-2020-10687 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 (HTTP request smuggling) is not present in Undertow 2.3.17.Final. All three upstream fix commits (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) were already included in the upstream 2.3.17.Final release before TuxCare onboarding. The fixes validate request characters, reject inappropriate whitespace (tabs/newlines/carriage returns in wrong positions, spaces in header names), and v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10687" }, "impact_statement": "not_affected \u2014 CVE-2020-10687 (HTTP request smuggling) is not present in Undertow 2.3.17.Final. All three upstream fix commits (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) were already included in the upstream 2.3.17.Final release before TuxCare onboarding. The fixes validate request characters, reject inappropriate whitespace (tabs/newlines/carriage returns in wrong positions, spaces in header names), and v..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:22:29.685630+00:00", "status_notes": "Vulnerability CVE-2020-10705 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-10705 affects Undertow versions before 2.1.1.Final. The target version 2.3.17.Final already contains the upstream fix (UNDERTOW-1657) that was authored by Red Hat engineers and shipped in the upstream release before TuxCare onboarded this version. The vulnerability pattern (buffer leak in Expect: 100-continue handling) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10705" }, "impact_statement": "CVE-2020-10705 affects Undertow versions before 2.1.1.Final. The target version 2.3.17.Final already contains the upstream fix (UNDERTOW-1657) that was authored by Red Hat engineers and shipped in the upstream release before TuxCare onboarded this version. The vulnerability pattern (buffer leak in Expect: 100-continue handling) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T02:32:36.583439+00:00", "status_notes": "Vulnerability CVE-2020-10719 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT AFFECTED by CVE-2020-10719. The vulnerability pattern (unbounded chunk-size accumulation leading to integer overflow and request smuggling) has been removed by an upstream fix that was already present in the 2.3.17.Final release that TuxCare onboarded. The fix was authored by Red Hat developers and shipped in the upstream release be...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10719" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT AFFECTED by CVE-2020-10719. The vulnerability pattern (unbounded chunk-size accumulation leading to integer overflow and request smuggling) has been removed by an upstream fix that was already present in the 2.3.17.Final release that TuxCare onboarded. The fix was authored by Red Hat developers and shipped in the upstream release be..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:37:16.972133+00:00", "status_notes": "Vulnerability CVE-2020-1745 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-1745 is NOT present in Undertow 2.3.17.Final-tuxcare.2. The vulnerability (arbitrary file access via malicious AJP request attributes) was fixed in upstream commit e60e04f4e by Red Hat, which was included in the upstream 2.3.17.Final release that TuxCare onboarded. The defensive code is present in AjpRequestParser.java:511-520, which validates all AJP request attributes against a known safe list (ATTR_SET) and an optional pattern, silently ignoring unknown attributes that don't match either criterion. This prevents attackers from using malicious attributes like javax.servlet.include.* to access arbitrary files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-1745" }, "impact_statement": "CVE-2020-1745 is NOT present in Undertow 2.3.17.Final-tuxcare.2. The vulnerability (arbitrary file access via malicious AJP request attributes) was fixed in upstream commit e60e04f4e by Red Hat, which was included in the upstream 2.3.17.Final release that TuxCare onboarded. The defensive code is present in AjpRequestParser.java:511-520, which validates all AJP request attributes against a known safe list (ATTR_SET) and an optional pattern, silently ignoring unknown attributes that don't match either criterion. This prevents attackers from using malicious attributes like javax.servlet.include.* to access arbitrary files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1757 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core.", "vulnerability": { "name": "CVE-2020-1757" }, "action_statement": "Vulnerability CVE-2020-1757 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:12:40.044104+00:00", "status_notes": "Vulnerability CVE-2020-27782 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-27782 is not present in Undertow 2.3.17.Final. Both required fixes (UNDERTOW-1404 and UNDERTOW-1824) were already included in the upstream 2.3.17.Final release before TuxCare onboarded it. The fixes were committed by upstream developers in 2018 and 2020, years before the 2.3.17.Final release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27782" }, "impact_statement": "CVE-2020-27782 is not present in Undertow 2.3.17.Final. Both required fixes (UNDERTOW-1404 and UNDERTOW-1824) were already included in the upstream 2.3.17.Final release before TuxCare onboarded it. The fixes were committed by upstream developers in 2018 and 2020, years before the 2.3.17.Final release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T03:43:00.092700+00:00", "status_notes": "Vulnerability CVE-2021-20220 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.3.17.Final is not affected by CVE-2021-20220. The vulnerability concerns HTTP request smuggling due to permitting invalid characters in HTTP requests (both HTTP/1.x and HTTP/2). The upstream fix (UNDERTOW-1780 and UNDERTOW-1774) adds comprehensive byte-level validation of HTTP/2 pseudo-headers (:path, :scheme, :authority, :method) and rejects whitespace in HTTP/1.x header ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20220" }, "impact_statement": "not_affected \u2014 The target Undertow 2.3.17.Final is not affected by CVE-2021-20220. The vulnerability concerns HTTP request smuggling due to permitting invalid characters in HTTP requests (both HTTP/1.x and HTTP/2). The upstream fix (UNDERTOW-1780 and UNDERTOW-1774) adds comprehensive byte-level validation of HTTP/2 pseudo-headers (:path, :scheme, :authority, :method) and rejects whitespace in HTTP/1.x header ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T23:38:00.240793+00:00", "status_notes": "Vulnerability CVE-2021-3597 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 affects Undertow versions prior to 2.2.9.Final and 2.0.39.Final. The vulnerability involves AbstractFramedStreamSinkChannel.flushComplete() failing to requeue the final frame when buffer flushing leaves remaining data, causing streams to never close properly and resulting in denial of service. The target version 2.3.17.Final already contains the upstream fix (commit b92904715) whi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3597" }, "impact_statement": "not_affected \u2014 CVE-2021-3597 affects Undertow versions prior to 2.2.9.Final and 2.0.39.Final. The vulnerability involves AbstractFramedStreamSinkChannel.flushComplete() failing to requeue the final frame when buffer flushing leaves remaining data, causing streams to never close properly and resulting in denial of service. The target version 2.3.17.Final already contains the upstream fix (commit b92904715) whi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T00:10:00.106947+00:00", "status_notes": "Vulnerability CVE-2021-3629 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3629 (HTTP/2 flow control DoS) is NOT present in Undertow 2.3.17.Final. The vulnerability involved indefinite blocking when waiting for HTTP/2 WINDOW_UPDATE frames from clients, allowing DoS through thread exhaustion. The upstream fix (UNDERTOW-1910, commit a4e7b1dbd) was already present in the 2.3.17.Final release that TuxCare onboarded, authored by Red Hat engineer frainone@redhat.co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3629" }, "impact_statement": "not_affected \u2014 CVE-2021-3629 (HTTP/2 flow control DoS) is NOT present in Undertow 2.3.17.Final. The vulnerability involved indefinite blocking when waiting for HTTP/2 WINDOW_UPDATE frames from clients, allowing DoS through thread exhaustion. The upstream fix (UNDERTOW-1910, commit a4e7b1dbd) was already present in the 2.3.17.Final release that TuxCare onboarded, authored by Red Hat engineer frainone@redhat.co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:25:55.953386+00:00", "status_notes": "Vulnerability CVE-2021-3690 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2021-3690 is NOT present in the target. The vulnerability involved a buffer leak when WebSocket PONG messages were received but no handler was registered - the buffer was never freed, leading to memory exhaustion. The fix (commit c7e84a0b7) adds an else clause that explicitly calls bufferedBinaryMessage.getData().free() when no handler exists. This fix is present in the target at FrameHandler.java lines 155-157. The fix was included in upstream Undertow 2.3.17.Final before TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3690" }, "impact_statement": "CVE-2021-3690 is NOT present in the target. The vulnerability involved a buffer leak when WebSocket PONG messages were received but no handler was registered - the buffer was never freed, leading to memory exhaustion. The fix (commit c7e84a0b7) adds an else clause that explicitly calls bufferedBinaryMessage.getData().free() when no handler exists. This fix is present in the target at FrameHandler.java lines 155-157. The fix was included in upstream Undertow 2.3.17.Final before TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:47:30.687322+00:00", "status_notes": "Vulnerability CVE-2021-3859 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT affected by CVE-2021-3859. The vulnerability, which caused denial of service through improper handling of HTTP/2 CONTINUATION frames, was fixed in upstream commit e43f0ada3f4da6e8579e0020cec3cb1a81e487c2 by Red Hat developers. This fix was already present in Undertow 2.3.17.Final when TuxCare onboarded it (first TuxCare commit 2a4e13f4599cac4a7a0eee712e65ea384c59661b). The CVE affects versions less than 2.2.15.Final, and this is version 2.3.17.Final. Both required code changes are present: (1) Http2Channel.parseFrame() now loops to consume all buffered continuation frames, and (2) HpackEncoder iterator advancement is correctly positioned.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3859" }, "impact_statement": "The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT affected by CVE-2021-3859. The vulnerability, which caused denial of service through improper handling of HTTP/2 CONTINUATION frames, was fixed in upstream commit e43f0ada3f4da6e8579e0020cec3cb1a81e487c2 by Red Hat developers. This fix was already present in Undertow 2.3.17.Final when TuxCare onboarded it (first TuxCare commit 2a4e13f4599cac4a7a0eee712e65ea384c59661b). The CVE affects versions less than 2.2.15.Final, and this is version 2.3.17.Final. Both required code changes are present: (1) Http2Channel.parseFrame() now loops to consume all buffered continuation frames, and (2) HpackEncoder iterator advancement is correctly positioned.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:52:09.053481+00:00", "status_notes": "Vulnerability CVE-2022-2053 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.3.17.Final) is NOT AFFECTED by CVE-2022-2053. The vulnerability was fixed in upstream version 2.3.0.Alpha2 (commit 2825b026d) and that fix is present in the target. The fix adds a specific catch block for RequestTooBigException that re-throws it (allowing proper error handling upstream) instead of letting it fall into the generic exception handler that improperly closes the connection via IoUtils.safeClose(). Since the target version 2.3.17.Final is newer than 2.3.0.Alpha2 and contains the upstream fix, the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2053" }, "impact_statement": "The target repository (Undertow 2.3.17.Final) is NOT AFFECTED by CVE-2022-2053. The vulnerability was fixed in upstream version 2.3.0.Alpha2 (commit 2825b026d) and that fix is present in the target. The fix adds a specific catch block for RequestTooBigException that re-throws it (allowing proper error handling upstream) instead of letting it fall into the generic exception handler that improperly closes the connection via IoUtils.safeClose(). Since the target version 2.3.17.Final is newer than 2.3.0.Alpha2 and contains the upstream fix, the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:19:18.164920+00:00", "status_notes": "Vulnerability CVE-2022-4492 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.3.17.Final) is not affected by CVE-2022-4492. The vulnerability\u2014missing server certificate hostname verification in HTTPS/HTTP2 client connections\u2014has been fixed in the upstream release. The fix commit e5071e52b (authored by rmartinc@redhat.com) was already present in upstream version 2.3.17.Final before TuxCare onboarded it. The fix sets ENDPOINT_IDENTIFICATION_ALGORITHM to \"HTTPS\" by default in HttpClientProvider and Http2ClientProvider, enabling proper hostname verification during TLS handshakes. All required code changes are present in the target: HttpClientProvider.java lines 94, 120; Http2ClientProvider.java lines 90, 109; and UndertowXnioSsl.java lines 326, 487.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-4492" }, "impact_statement": "The target repository (Undertow 2.3.17.Final) is not affected by CVE-2022-4492. The vulnerability\u2014missing server certificate hostname verification in HTTPS/HTTP2 client connections\u2014has been fixed in the upstream release. The fix commit e5071e52b (authored by rmartinc@redhat.com) was already present in upstream version 2.3.17.Final before TuxCare onboarded it. The fix sets ENDPOINT_IDENTIFICATION_ALGORITHM to \"HTTPS\" by default in HttpClientProvider and Http2ClientProvider, enabling proper hostname verification during TLS handshakes. All required code changes are present in the target: HttpClientProvider.java lines 94, 120; Http2ClientProvider.java lines 90, 109; and UndertowXnioSsl.java lines 326, 487.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:32:43.249791+00:00", "status_notes": "Vulnerability CVE-2023-1108 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2023-1108 is NOT present in Undertow 2.3.17.Final. The vulnerability was fixed in the upstream release before TuxCare onboarded this version. The fix adds a check `&& !engine.isInboundDone()` to the while loop condition in SslConduit.wrapAndFlip() method (line 1011), preventing infinite loops when the SSL engine's inbound channel is closed. The fix commit (ccc053b55) by Flavia Rainone (frainone@redhat.com) is an ancestor of the 2.3.17.Final release preparation commit (cdeb242dc), confirming it was included in the upstream release that TuxCare onboarded at commit 2a4e13f45.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-1108" }, "impact_statement": "CVE-2023-1108 is NOT present in Undertow 2.3.17.Final. The vulnerability was fixed in the upstream release before TuxCare onboarded this version. The fix adds a check `&& !engine.isInboundDone()` to the while loop condition in SslConduit.wrapAndFlip() method (line 1011), preventing infinite loops when the SSL engine's inbound channel is closed. The fix commit (ccc053b55) by Flavia Rainone (frainone@redhat.com) is an ancestor of the 2.3.17.Final release preparation commit (cdeb242dc), confirming it was included in the upstream release that TuxCare onboarded at commit 2a4e13f45.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:50:52.202330+00:00", "status_notes": "Vulnerability CVE-2023-1973 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. The target Undertow 2.3.17.Final already contains the upstream fix for CVE-2023-1973. The vulnerability pattern (unbounded session lifetime during form authentication) is not present because the fix was included in the upstream 2.3.17.Final release that TuxCare onboarded. Both FormAuthenticationMechanism.java and ServletFormAuthenticationMechanism.java contain the session timeout limiting logic (authenticationSessionTimeout = 120 seconds) that prevents the DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final), Snyk (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-1973" }, "impact_statement": "The target Undertow 2.3.17.Final already contains the upstream fix for CVE-2023-1973. The vulnerability pattern (unbounded session lifetime during form authentication) is not present because the fix was included in the upstream 2.3.17.Final release that TuxCare onboarded. Both FormAuthenticationMechanism.java and ServletFormAuthenticationMechanism.java contain the session timeout limiting logic (authenticationSessionTimeout = 120 seconds) that prevents the DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final), Snyk (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:28:48.622691+00:00", "status_notes": "Vulnerability CVE-2023-4639 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2023-4639 (cookie parsing vulnerability allowing HttpOnly cookie exfiltration) is NOT present in Undertow 2.3.17.Final. The upstream fix (commit 1f93a979d) was already included in the 2.3.17.Final release that TuxCare onboarded. The fix, authored by baranowb@gmail.com and committed by frainone@redhat.com (both non-TuxCare domains), is an ancestor of the onboarding commit 2a4e13f45, confirming it shipped with the upstream release. The defensive code is present at Cookies.java:321-324, which rejects cookies with unterminated quoted values when delimiters are encountered before the closing quote.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.11.Final; < 2.2.30.Final), Snyk (< 2.2.30.Final; >= 2.3.0.Alpha1, < 2.3.11.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-4639" }, "impact_statement": "CVE-2023-4639 (cookie parsing vulnerability allowing HttpOnly cookie exfiltration) is NOT present in Undertow 2.3.17.Final. The upstream fix (commit 1f93a979d) was already included in the 2.3.17.Final release that TuxCare onboarded. The fix, authored by baranowb@gmail.com and committed by frainone@redhat.com (both non-TuxCare domains), is an ancestor of the onboarding commit 2a4e13f45, confirming it shipped with the upstream release. The defensive code is present at Cookies.java:321-324, which rejects cookies with unterminated quoted values when delimiters are encountered before the closing quote.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.11.Final; < 2.2.30.Final), Snyk (< 2.2.30.Final; >= 2.3.0.Alpha1, < 2.3.11.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T01:49:00.101185+00:00", "status_notes": "Vulnerability CVE-2024-1459 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT affected by CVE-2024-1459. The vulnerability was fixed in upstream commits 9b7c5037e and 54f3e4325 by Red Hat developers (thofman@redhat.com, frainone@redhat.com), and these fixes were already included in upstream release 2.3.17.Final before TuxCare onboarded it. The fix prevents path traversal by preserving semicolons in dot-segmen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1459" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT affected by CVE-2024-1459. The vulnerability was fixed in upstream commits 9b7c5037e and 54f3e4325 by Red Hat developers (thofman@redhat.com, frainone@redhat.com), and these fixes were already included in upstream release 2.3.17.Final before TuxCare onboarded it. The fix prevents path traversal by preserving semicolons in dot-segmen..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:49:38.434607+00:00", "status_notes": "Vulnerability CVE-2024-1635 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2024-1635 is not present in target version 2.3.17.Final. The upstream fix (commit e3bcd5b4 by frainone@redhat.com) was already shipped in the upstream Undertow 2.3.17.Final release before TuxCare onboarded it. The fix includes: (1) volatile handle field, (2) close listener in constructor that removes timeout task handle when connection closes, (3) synchronized blocks around all handle operations, and (4) try-finally blocks ensuring cleanup in terminateWrites/truncateWrites. All defense components are present in WriteTimeoutStreamSinkConduit.java at lines 50, 85-94, 138-145, 155-162, 220-233, 236-249, 267-273, and 292-296.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Final, < 2.3.12.Final; < 2.2.31.Final), cve.org (= 1.31.0), Snyk (< 2.2.31.Final; >= 2.3.0.Final, < 2.3.12.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1635" }, "impact_statement": "CVE-2024-1635 is not present in target version 2.3.17.Final. The upstream fix (commit e3bcd5b4 by frainone@redhat.com) was already shipped in the upstream Undertow 2.3.17.Final release before TuxCare onboarded it. The fix includes: (1) volatile handle field, (2) close listener in constructor that removes timeout task handle when connection closes, (3) synchronized blocks around all handle operations, and (4) try-finally blocks ensuring cleanup in terminateWrites/truncateWrites. All defense components are present in WriteTimeoutStreamSinkConduit.java at lines 50, 85-94, 138-145, 155-162, 220-233, 236-249, 267-273, and 292-296.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Final, < 2.3.12.Final; < 2.2.31.Final), cve.org (= 1.31.0), Snyk (< 2.2.31.Final; >= 2.3.0.Final, < 2.3.12.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T23:32:00.169654+00:00", "status_notes": "Vulnerability CVE-2024-3653 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2024-3653 affects Undertow's LearningPushHandler which previously used unbounded HashMap storage for nested caches, allowing memory exhaustion via crafted HTTP requests with varying Referer headers. The target version 2.3.17.Final ships with upstream commits 6b8e79c16 and a03e5189b already applied, which replace unbounded HashMaps with bounded LRUCache instances enforcing size and age limit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3653" }, "impact_statement": "not_affected \u2014 CVE-2024-3653 affects Undertow's LearningPushHandler which previously used unbounded HashMap storage for nested caches, allowing memory exhaustion via crafted HTTP requests with varying Referer headers. The target version 2.3.17.Final ships with upstream commits 6b8e79c16 and a03e5189b already applied, which replace unbounded HashMaps with bounded LRUCache instances enforcing size and age limit..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3884 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core.", "vulnerability": { "name": "CVE-2024-3884" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4027 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core.", "vulnerability": { "name": "CVE-2024-4027" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.3.17.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2024-4109" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:27:39.447287+00:00", "status_notes": "Vulnerability CVE-2024-5971 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2024-5971 is not present in target version 2.3.17.Final. The fix was already included in the upstream 2.3.17.Final release before TuxCare onboarded it. The vulnerable code pattern (incorrect byte consumption accounting in SslConduit.wrapAndFlip when multiple SSL wrap calls occur) has been replaced with the upstream fix that properly tracks and reports total bytes consumed across all wrap iterations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.15.Final; < 2.2.34.Final), cve.org (< 2.2.34.Final; >= 2.3.0.Alpha1, < 2.3.15.Final), Snyk (< 2.2.34.Final; >= 2.3.0.Final, < 2.3.8.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-5971" }, "impact_statement": "CVE-2024-5971 is not present in target version 2.3.17.Final. The fix was already included in the upstream 2.3.17.Final release before TuxCare onboarded it. The vulnerable code pattern (incorrect byte consumption accounting in SslConduit.wrapAndFlip when multiple SSL wrap calls occur) has been replaced with the upstream fix that properly tracks and reports total bytes consumed across all wrap iterations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.15.Final; < 2.2.34.Final), cve.org (< 2.2.34.Final; >= 2.3.0.Alpha1, < 2.3.15.Final), Snyk (< 2.2.34.Final; >= 2.3.0.Final, < 2.3.8.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:57:15.327260+00:00", "status_notes": "Vulnerability CVE-2024-6162 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.3.17.Final) is NOT AFFECTED by CVE-2024-6162. The vulnerable pattern - a shared mutable StringBuilder instance field `decodeBuffer` used across concurrent AJP request parsing - is not present in the target code. The fix was already included in the upstream 2.3.17.Final release before TuxCare onboarded it. At AjpRequestParser.java:532, the decodeBuffer is correctly declared as a local variable (`final StringBuilder decodeBuffer = new StringBuilder();`), created fresh in each invocation of the decode() method, preventing the race condition described in the CVE. Fix commit 90f202ada by Red Hat developer Tomas Hofman is an ancestor of the TuxCare onboarding commit 2a4e13f45.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.14.Final; < 2.2.33.Final), cve.org (< 2.2.33.Final; >= 2.3.0.Alpha1, < 2.3.14), Snyk (< 2.2.33.Final; >= 2.3.0.Final, < 2.3.14.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-6162" }, "impact_statement": "The target repository (Undertow 2.3.17.Final) is NOT AFFECTED by CVE-2024-6162. The vulnerable pattern - a shared mutable StringBuilder instance field `decodeBuffer` used across concurrent AJP request parsing - is not present in the target code. The fix was already included in the upstream 2.3.17.Final release before TuxCare onboarded it. At AjpRequestParser.java:532, the decodeBuffer is correctly declared as a local variable (`final StringBuilder decodeBuffer = new StringBuilder();`), created fresh in each invocation of the decode() method, preventing the race condition described in the CVE. Fix commit 90f202ada by Red Hat developer Tomas Hofman is an ancestor of the TuxCare onboarding commit 2a4e13f45.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.14.Final; < 2.2.33.Final), cve.org (< 2.2.33.Final; >= 2.3.0.Alpha1, < 2.3.14), Snyk (< 2.2.33.Final; >= 2.3.0.Final, < 2.3.14.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-06T17:48:33.516993+00:00", "status_notes": "Vulnerability CVE-2024-7885 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. Prechecker: A change identical to the upstream fix is already in this version's source history. The upstream fix was released in 2.3.17.Final, which is this version. Advisories: GitHub GHSA-9623-mqmm-5rcf (fixed in 2.3.17.Final), CVE record (fixed in 2.3.17.Final), Snyk (fixed in 2.3.17.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-7885" }, "impact_statement": "Prechecker: A change identical to the upstream fix is already in this version's source history. The upstream fix was released in 2.3.17.Final, which is this version. Advisories: GitHub GHSA-9623-mqmm-5rcf (fixed in 2.3.17.Final), CVE record (fixed in 2.3.17.Final), Snyk (fixed in 2.3.17.Final)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12543 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core.", "vulnerability": { "name": "CVE-2025-12543" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-9784 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core.", "vulnerability": { "name": "CVE-2025-9784" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T21:20:00.078709+00:00", "status_notes": "Vulnerability CVE-2026-28367 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core.", "vulnerability": { "name": "CVE-2026-28367" }, "action_statement": "Vulnerability CVE-2026-28367 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T21:26:00.126687+00:00", "status_notes": "Vulnerability CVE-2026-28368 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core.", "vulnerability": { "name": "CVE-2026-28368" }, "action_statement": "Vulnerability CVE-2026-28368 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T20:47:05.334467+00:00", "status_notes": "Vulnerability CVE-2026-28369 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core. already_fixed \u2014 The target repository (Undertow 2.3.17.Final) already contains UNDERTOW-1774, a fix from February 2020 that causes the HTTP parser to reject requests where header field-names start with whitespace characters. This fix addresses the core vulnerability described in CVE-2026-28369 by throwing BadRequestException when such malformed headers are encountered, preventing request smuggling attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-28369" }, "impact_statement": "already_fixed \u2014 The target repository (Undertow 2.3.17.Final) already contains UNDERTOW-1774, a fix from February 2020 that causes the HTTP parser to reject requests where header field-names start with whitespace characters. This fix addresses the core vulnerability described in CVE-2026-28369 by throwing BadRequestException when such malformed headers are encountered, preventing request smuggling attacks." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-core@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3260 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core.", "vulnerability": { "name": "CVE-2026-3260" }, "action_statement": "Vulnerability CVE-2026-3260 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-core." } ] }