{
  "@id": "urn:uuid:49821648-f5d6-4e03-b3d3-9d31fee17779",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 45,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:48:33.516993+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T04:45:19.158461+00:00",
      "status_notes": "Vulnerability CVE-2014-7816 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 directory traversal vulnerability is NOT present in target version 2.3.18.Final-tuxcare.3. The upstream fix (commit 28f244e63 by Stuart Douglas) was already included in the upstream release 2.3.18.Final when TuxCare onboarded it. The fix adds checks that reject resource paths containing Windows path separators on Windows systems, preventing directory traversal via backslash charac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7816"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7816 directory traversal vulnerability is NOT present in target version 2.3.18.Final-tuxcare.3. The upstream fix (commit 28f244e63 by Stuart Douglas) was already included in the upstream release 2.3.18.Final when TuxCare onboarded it. The fix adds checks that reject resource paths containing Windows path separators on Windows systems, preventing directory traversal via backslash charac..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T04:01:32.609663+00:00",
      "status_notes": "Vulnerability CVE-2016-7046 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 affects Undertow versions vulnerable to BufferOverflowException when processing long URL proxy requests. The target version 2.3.18.Final-tuxcare.3 contains the complete upstream fix authored by Stuart Douglas in September 2016. All three affected files (HttpRequestConduit.java, HpackEncoder.java, ProxyHandler.java) implement the defense mechanisms: buffer capacity pre-checking wit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-7046"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-7046 affects Undertow versions vulnerable to BufferOverflowException when processing long URL proxy requests. The target version 2.3.18.Final-tuxcare.3 contains the complete upstream fix authored by Stuart Douglas in September 2016. All three affected files (HttpRequestConduit.java, HpackEncoder.java, ProxyHandler.java) implement the defense mechanisms: buffer capacity pre-checking wit..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T03:57:59.975111+00:00",
      "status_notes": "Vulnerability CVE-2017-12165 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.3.18.Final-tuxcare.3 is NOT AFFECTED by CVE-2017-12165 (HTTP request smuggling via unusual whitespaces in headers). All required defenses are present: (1) RFC 7230 token validation for header names and HTTP methods via Connectors.verifyToken(), (2) duplicate/conflicting Content-Length and Transfer-Encoding header detection via Connectors.areRequestHeadersValid(), and (3) r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12165"
      },
      "impact_statement": "not_affected \u2014 The target Undertow 2.3.18.Final-tuxcare.3 is NOT AFFECTED by CVE-2017-12165 (HTTP request smuggling via unusual whitespaces in headers). All required defenses are present: (1) RFC 7230 token validation for header names and HTTP methods via Connectors.verifyToken(), (2) duplicate/conflicting Content-Length and Transfer-Encoding header detection via Connectors.areRequestHeadersValid(), and (3) r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T23:44:00.212234+00:00",
      "status_notes": "Vulnerability CVE-2017-12196 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is NOT present in this target. The vulnerability fix was already included in the upstream Undertow 2.3.18.Final release. The DigestAuthenticationMechanism.java file contains the complete URI validation logic (lines 235-259) that prevents the MITM attack by ensuring the URI in the Digest Authorization header matches the actual HTTP request URI. This fix was authored by Stuart Doug...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12196"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-12196 is NOT present in this target. The vulnerability fix was already included in the upstream Undertow 2.3.18.Final release. The DigestAuthenticationMechanism.java file contains the complete URI validation logic (lines 235-259) that prevents the MITM attack by ensuring the URI in the Digest Authorization header matches the actual HTTP request URI. This fix was authored by Stuart Doug..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T04:28:00.102165+00:00",
      "status_notes": "Vulnerability CVE-2017-2666 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.3.18.Final-tuxcare.3 is NOT AFFECTED by CVE-2017-2666. The vulnerability pattern (accepting invalid characters in HTTP request lines enabling request smuggling) is not present because the upstream fix was already included in the 2.3.18.Final release that TuxCare onboarded. All three defense mechanisms from the CVE patches are present and active by default: (1) RFC 7230 tok...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-2666"
      },
      "impact_statement": "not_affected \u2014 The target Undertow 2.3.18.Final-tuxcare.3 is NOT AFFECTED by CVE-2017-2666. The vulnerability pattern (accepting invalid characters in HTTP request lines enabling request smuggling) is not present because the upstream fix was already included in the 2.3.18.Final release that TuxCare onboarded. All three defense mechanisms from the CVE patches are present and active by default: (1) RFC 7230 tok..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-2670 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2017-2670 affects Undertow before 1.3.28 with a WebSocket infinite loop DoS when non-clean TCP close occurs. The target version 2.3.18.Final already contains the upstream fix (commit 9bfe9fbbb) that was shipped in the original 2.3.18.Final release. The fix adds STATE_STREAM_BROKEN to the loop exit condition in AbstractFramedStreamSourceChannel.java at line 301, preventing infinite loops when streams break. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-2670"
      },
      "impact_statement": "CVE-2017-2670 affects Undertow before 1.3.28 with a WebSocket infinite loop DoS when non-clean TCP close occurs. The target version 2.3.18.Final already contains the upstream fix (commit 9bfe9fbbb) that was shipped in the original 2.3.18.Final release. The fix adds STATE_STREAM_BROKEN to the loop exit condition in AbstractFramedStreamSourceChannel.java at line 301, preventing infinite loops when streams break. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:38:11.241648+00:00",
      "status_notes": "Vulnerability CVE-2017-7559 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 describes an incomplete fix for CVE-2017-2666 where invalid characters were still allowed in query strings and path parameters, enabling HTTP response injection attacks. The target version 2.3.18.Final-tuxcare.3 is NOT affected because the complete fix was already present in the upstream release that TuxCare onboarded. The fix (commit 3436b03eda, UNDERTOW-1165, August 4, 2017) by ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7559"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-7559 describes an incomplete fix for CVE-2017-2666 where invalid characters were still allowed in query strings and path parameters, enabling HTTP response injection attacks. The target version 2.3.18.Final-tuxcare.3 is NOT affected because the complete fix was already present in the upstream release that TuxCare onboarded. The fix (commit 3436b03eda, UNDERTOW-1165, August 4, 2017) by ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T00:17:00.126158+00:00",
      "status_notes": "Vulnerability CVE-2018-1114 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-1114 describes a file descriptor leak in URLResource.getLastModified() when handling JAR URLs. The vulnerable pattern called URLConnection.getLastModified() on JarURLConnection objects with caching enabled, causing file descriptors to remain open until finalization. The target repository version 2.3.18.Final already contains the upstream fix (commit 882d5884f from April 2018) that disa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1114"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1114 describes a file descriptor leak in URLResource.getLastModified() when handling JAR URLs. The vulnerable pattern called URLConnection.getLastModified() on JarURLConnection objects with caching enabled, causing file descriptors to remain open until finalization. The target repository version 2.3.18.Final already contains the upstream fix (commit 882d5884f from April 2018) that disa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T04:15:00.311363+00:00",
      "status_notes": "Vulnerability CVE-2018-14642 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target Undertow 2.3.18.Final is NOT affected by CVE-2018-14642. The vulnerability involved an information leak where HttpResponseConduit.java would write the entire buffer array length instead of only the valid data length, potentially exposing data from previous requests. The upstream fix (commit a83b047d5 by Stuart Douglas, dated 2018-09-13) changed `next.write(data, 0, data.length)` to `...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14642"
      },
      "impact_statement": "not_affected \u2014 The target Undertow 2.3.18.Final is NOT affected by CVE-2018-14642. The vulnerability involved an information leak where HttpResponseConduit.java would write the entire buffer array length instead of only the valid data length, potentially exposing data from previous requests. The upstream fix (commit a83b047d5 by Stuart Douglas, dated 2018-09-13) changed `next.write(data, 0, data.length)` to `..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:52:53.936815+00:00",
      "status_notes": "Vulnerability CVE-2019-10212 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. The target repository (Undertow 2.3.18.Final) is NOT AFFECTED by CVE-2019-10212. The vulnerability involved DEBUG-level logging that exposed user credentials in plaintext in two locations: (1) BasicAuthenticationMechanism logging the plainChallenge (username:password) and base64Challenge, and (2) HttpServerExchange.toString() including request/response headers that could contain Authorization headers. Both fixes were shipped in the upstream Undertow release and are present in version 2.3.18.Final. The vulnerable code patterns have been removed by upstream commits 8b63e2585 (UNDERTOW-1576) and 20cacc96c (UNDERTOW-1515), which are ancestors of the target's HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10212"
      },
      "impact_statement": "The target repository (Undertow 2.3.18.Final) is NOT AFFECTED by CVE-2019-10212. The vulnerability involved DEBUG-level logging that exposed user credentials in plaintext in two locations: (1) BasicAuthenticationMechanism logging the plainChallenge (username:password) and base64Challenge, and (2) HttpServerExchange.toString() including request/response headers that could contain Authorization headers. Both fixes were shipped in the upstream Undertow release and are present in version 2.3.18.Final. The vulnerable code patterns have been removed by upstream commits 8b63e2585 (UNDERTOW-1576) and 20cacc96c (UNDERTOW-1515), which are ancestors of the target's HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:30:34.591989+00:00",
      "status_notes": "Vulnerability CVE-2019-14888 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-14888 affects Undertow versions before 2.0.29. The target version 2.3.18.Final includes upstream fixes that prevent the HTTPS deadlock vulnerability through alternative synchronization strategies. The fixes move frame queueing operations (queueFrame, queueFinalFrame) outside synchronized blocks and add state tracking (STATE_READS_AWAKEN, writeSucceeded) to prevent race conditions, eliminating the deadlock pattern that caused service unavailability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.29.Final), NVD (<= 2.0.28), cve.org (< 2.0.28.SP1), Snyk (< 2.0.29.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14888"
      },
      "impact_statement": "CVE-2019-14888 affects Undertow versions before 2.0.29. The target version 2.3.18.Final includes upstream fixes that prevent the HTTPS deadlock vulnerability through alternative synchronization strategies. The fixes move frame queueing operations (queueFrame, queueFinalFrame) outside synchronized blocks and add state tracking (STATE_READS_AWAKEN, writeSucceeded) to prevent race conditions, eliminating the deadlock pattern that caused service unavailability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.29.Final), NVD (<= 2.0.28), cve.org (< 2.0.28.SP1), Snyk (< 2.0.29.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2019-3888 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2019-3888 is NOT present in Undertow 2.3.18.Final. The vulnerability involved credential exposure in log files through two mechanisms: (1) HttpServerExchange.toString() included request/response headers containing credentials, and (2) BasicAuthenticationMechanism logged plaintext credentials at DEBUG level. Both fixes were applied in upstream commits 20cacc96c (March 2019, UNDERTOW-1515) and 8b63e2585 (October 2019, UNDERTOW-1576), which are present in the 2.3.18.Final release that TuxCare onboarded. The vulnerable code patterns are absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3888"
      },
      "impact_statement": "CVE-2019-3888 is NOT present in Undertow 2.3.18.Final. The vulnerability involved credential exposure in log files through two mechanisms: (1) HttpServerExchange.toString() included request/response headers containing credentials, and (2) BasicAuthenticationMechanism logged plaintext credentials at DEBUG level. Both fixes were applied in upstream commits 20cacc96c (March 2019, UNDERTOW-1515) and 8b63e2585 (October 2019, UNDERTOW-1576), which are present in the 2.3.18.Final release that TuxCare onboarded. The vulnerable code patterns are absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T03:24:00.109850+00:00",
      "status_notes": "Vulnerability CVE-2020-10687 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 (HTTP request smuggling via invalid characters) is NOT present in Undertow 2.3.18.Final-tuxcare.3. The upstream vendor fixes (UNDERTOW-1780 a18574a4d and UNDERTOW-1165 3436b03ed) were already shipped in the upstream 2.3.18.Final release that TuxCare onboarded. These fixes add strict character validation to prevent protocol boundary confusion: (1) HTTP/2 pseudo-header validation u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10687"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-10687 (HTTP request smuggling via invalid characters) is NOT present in Undertow 2.3.18.Final-tuxcare.3. The upstream vendor fixes (UNDERTOW-1780 a18574a4d and UNDERTOW-1165 3436b03ed) were already shipped in the upstream 2.3.18.Final release that TuxCare onboarded. These fixes add strict character validation to prevent protocol boundary confusion: (1) HTTP/2 pseudo-header validation u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2020-10705 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. The target (Undertow 2.3.18.Final-tuxcare.3) is not affected by CVE-2020-10705. The vulnerability, which causes memory exhaustion via buffer leaks when handling \"Expect: 100-continue\" headers, was fixed by upstream Red Hat/JBoss in UNDERTOW-1657 before version 2.3.18.Final was released. All defensive code from patches 64bbaeb7c, aa5e1fe11, and b53d4589c is present in the target and was already included in the upstream release that TuxCare onboarded. The CVE affects versions before 2.1.1.Final; the target is 2.3.18.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10705"
      },
      "impact_statement": "The target (Undertow 2.3.18.Final-tuxcare.3) is not affected by CVE-2020-10705. The vulnerability, which causes memory exhaustion via buffer leaks when handling \"Expect: 100-continue\" headers, was fixed by upstream Red Hat/JBoss in UNDERTOW-1657 before version 2.3.18.Final was released. All defensive code from patches 64bbaeb7c, aa5e1fe11, and b53d4589c is present in the target and was already included in the upstream release that TuxCare onboarded. The CVE affects versions before 2.1.1.Final; the target is 2.3.18.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T02:29:00.231467+00:00",
      "status_notes": "Vulnerability CVE-2020-10719 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 is NOT present in the target. The vulnerability involved integer overflow in HTTP chunked transfer-encoding chunk size parsing, which could lead to HTTP request smuggling. The upstream vendor fix (commit bfc8fbd67) was already included in Undertow 2.3.18.Final before TuxCare onboarding. The fix adds a LIMIT constant (Long.MAX_VALUE >> 4) and validates the accumulated chunk size b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10719"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-10719 is NOT present in the target. The vulnerability involved integer overflow in HTTP chunked transfer-encoding chunk size parsing, which could lead to HTTP request smuggling. The upstream vendor fix (commit bfc8fbd67) was already included in Undertow 2.3.18.Final before TuxCare onboarding. The fix adds a LIMIT constant (Long.MAX_VALUE >> 4) and validates the accumulated chunk size b..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:57.157354+00:00",
      "status_notes": "Vulnerability CVE-2020-1745 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. Target version 2.3.18.Final-tuxcare.3 is NOT AFFECTED by CVE-2020-1745. The vulnerability was fixed in upstream version 2.0.30.Final (commit e60e04f4e by Red Hat engineer Masafumi Miura), and this fix is already present in the target version which is based on upstream 2.3.18.Final. The vulnerable pattern (blind acceptance of arbitrary AJP request attributes) has been replaced with validation logic that rejects unknown attributes by default. The fix was shipped in the upstream release and predates TuxCare's onboarding commit (596201731).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1745"
      },
      "impact_statement": "Target version 2.3.18.Final-tuxcare.3 is NOT AFFECTED by CVE-2020-1745. The vulnerability was fixed in upstream version 2.0.30.Final (commit e60e04f4e by Red Hat engineer Masafumi Miura), and this fix is already present in the target version which is based on upstream 2.3.18.Final. The vulnerable pattern (blind acceptance of arbitrary AJP request attributes) has been replaced with validation logic that rejects unknown attributes by default. The fix was shipped in the upstream release and predates TuxCare's onboarding commit (596201731).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2020-1757 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core.",
      "vulnerability": {
        "name": "CVE-2020-1757"
      },
      "action_statement": "Vulnerability CVE-2020-1757 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:09:40.812233+00:00",
      "status_notes": "Vulnerability CVE-2020-27782 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2020-27782 is not present in Undertow 2.3.18.Final-tuxcare.3. Both required fixes (UNDERTOW-1404 and UNDERTOW-1824) were already included in the upstream 2.3.18.Final release when TuxCare onboarded it on 2026-03-31. The vulnerability pattern (unhandled IllegalArgumentException during AJP query string parsing causing DoS) is absent because upstream developers added proper exception handling in 2018 (UNDERTOW-1404) and 2020 (UNDERTOW-1824).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27782"
      },
      "impact_statement": "CVE-2020-27782 is not present in Undertow 2.3.18.Final-tuxcare.3. Both required fixes (UNDERTOW-1404 and UNDERTOW-1824) were already included in the upstream 2.3.18.Final release when TuxCare onboarded it on 2026-03-31. The vulnerability pattern (unhandled IllegalArgumentException during AJP query string parsing causing DoS) is absent because upstream developers added proper exception handling in 2018 (UNDERTOW-1404) and 2020 (UNDERTOW-1824).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T03:42:00.114565+00:00",
      "status_notes": "Vulnerability CVE-2021-20220 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target (Undertow 2.3.18.Final-tuxcare.3) is not affected by CVE-2021-20220. The vulnerability involves HTTP request smuggling through invalid characters in HTTP/2 pseudo-headers and HTTP/1.x header field names. All required fixes (UNDERTOW-1780 for HTTP/2 pseudo-header validation, UNDERTOW-1774 for whitespace handling) were included in the upstream 2.3.18.Final release before TuxCare onboar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20220"
      },
      "impact_statement": "not_affected \u2014 The target (Undertow 2.3.18.Final-tuxcare.3) is not affected by CVE-2021-20220. The vulnerability involves HTTP request smuggling through invalid characters in HTTP/2 pseudo-headers and HTTP/1.x header field names. All required fixes (UNDERTOW-1780 for HTTP/2 pseudo-header validation, UNDERTOW-1774 for whitespace handling) were included in the upstream 2.3.18.Final release before TuxCare onboar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T23:36:00.286721+00:00",
      "status_notes": "Vulnerability CVE-2021-3597 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 is NOT present in the target. The vulnerability (UNDERTOW-1842) affected AbstractFramedStreamSinkChannel.flushComplete() where the final frame was not requeued when flush completed with remaining unflushed data, causing denial of service through incomplete stream closure. The fix (commit b92904715c5f5857827cf4201b9bce5844919259) was already present in upstream release 2.3.18.Final...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-3597"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-3597 is NOT present in the target. The vulnerability (UNDERTOW-1842) affected AbstractFramedStreamSinkChannel.flushComplete() where the final frame was not requeued when flush completed with remaining unflushed data, causing denial of service through incomplete stream closure. The fix (commit b92904715c5f5857827cf4201b9bce5844919259) was already present in upstream release 2.3.18.Final..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T00:07:00.112617+00:00",
      "status_notes": "Vulnerability CVE-2021-3629 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3629 (HTTP/2 flow control DoS via indefinite blocking) is NOT present in this target. The upstream fix (UNDERTOW-1910) shipped in Undertow 2.3.18.Final, which TuxCare onboarded. The vulnerable pattern (indefinite wait when peer withholds WINDOW_UPDATE frames) has been replaced with a timeout-based wait mechanism in AbstractFramedStreamSinkChannel.awaitWritable().",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-3629"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-3629 (HTTP/2 flow control DoS via indefinite blocking) is NOT present in this target. The upstream fix (UNDERTOW-1910) shipped in Undertow 2.3.18.Final, which TuxCare onboarded. The vulnerable pattern (indefinite wait when peer withholds WINDOW_UPDATE frames) has been replaced with a timeout-based wait mechanism in AbstractFramedStreamSinkChannel.awaitWritable()."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2021-3690 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. The target (Undertow 2.3.18.Final) is not affected by CVE-2021-3690. The vulnerability involved a buffer leak on incoming WebSocket PONG messages that could lead to memory exhaustion. The fix that prevents this leak (adding `bufferedBinaryMessage.getData().free()` in the else branch of the PONG handler) is present in the target code at FrameHandler.java lines 155-157. This fix was authored by upstream contributor Andrey Marinchuk (radist.nt@gmail.com) in commit c7e84a0b7 and was included in the upstream 2.3.18.Final release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-3690"
      },
      "impact_statement": "The target (Undertow 2.3.18.Final) is not affected by CVE-2021-3690. The vulnerability involved a buffer leak on incoming WebSocket PONG messages that could lead to memory exhaustion. The fix that prevents this leak (adding `bufferedBinaryMessage.getData().free()` in the else branch of the PONG handler) is present in the target code at FrameHandler.java lines 155-157. This fix was authored by upstream contributor Andrey Marinchuk (radist.nt@gmail.com) in commit c7e84a0b7 and was included in the upstream 2.3.18.Final release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:46:12.447284+00:00",
      "status_notes": "Vulnerability CVE-2021-3859 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2021-3859 affects Undertow versions prior to 2.2.15.Final due to improper handling of HTTP/2 continuation frames, causing connection hangs and DoS. The target version 2.3.18.Final already contains the upstream fix (commit e43f0ada3) that was released in 2.2.15.Final. Both critical patches are present: Http2Channel.java loops to consume continuation frames immediately, and HpackEncoder.java properly advances the iterator to prevent header reprocessing on overflow. The fix was authored by RedHat and shipped in the upstream release before TuxCare onboarded version 2.3.18.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-3859"
      },
      "impact_statement": "CVE-2021-3859 affects Undertow versions prior to 2.2.15.Final due to improper handling of HTTP/2 continuation frames, causing connection hangs and DoS. The target version 2.3.18.Final already contains the upstream fix (commit e43f0ada3) that was released in 2.2.15.Final. Both critical patches are present: Http2Channel.java loops to consume continuation frames immediately, and HpackEncoder.java properly advances the iterator to prevent header reprocessing on overflow. The fix was authored by RedHat and shipped in the upstream release before TuxCare onboarded version 2.3.18.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:51:28.138223+00:00",
      "status_notes": "Vulnerability CVE-2022-2053 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2022-2053 is not present in the target. The vulnerability was fixed in upstream Undertow 2.3.18.Final (commit 2825b026d by jason@steeplesoft.com) before TuxCare onboarded this version. The fix adds a specific catch-and-rethrow for RequestTooBigException in AjpServerRequestConduit, preventing silent connection closure when POST requests exceed max-post-size limits. The vulnerable code pattern (missing exception handling that caused DoS) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2053"
      },
      "impact_statement": "CVE-2022-2053 is not present in the target. The vulnerability was fixed in upstream Undertow 2.3.18.Final (commit 2825b026d by jason@steeplesoft.com) before TuxCare onboarded this version. The fix adds a specific catch-and-rethrow for RequestTooBigException in AjpServerRequestConduit, preventing silent connection closure when POST requests exceed max-post-size limits. The vulnerable code pattern (missing exception handling that caused DoS) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:19:18.164920+00:00",
      "status_notes": "Vulnerability CVE-2022-4492 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2022-4492 affects Undertow clients that do not verify server certificate hostname/identity in TLS connections. The fix (commit e5071e52b) sets ENDPOINT_IDENTIFICATION_ALGORITHM to \"HTTPS\" by default in HttpClientProvider and Http2ClientProvider. This fix was authored by Red Hat (rmartinc@redhat.com) and was already present in upstream version 2.3.18.Final when TuxCare onboarded it (commit 59620173). The target repository at version 2.3.18.Final-tuxcare.3 contains the complete fix in all TLS client code paths. The vulnerable pattern (missing hostname verification) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4492"
      },
      "impact_statement": "CVE-2022-4492 affects Undertow clients that do not verify server certificate hostname/identity in TLS connections. The fix (commit e5071e52b) sets ENDPOINT_IDENTIFICATION_ALGORITHM to \"HTTPS\" by default in HttpClientProvider and Http2ClientProvider. This fix was authored by Red Hat (rmartinc@redhat.com) and was already present in upstream version 2.3.18.Final when TuxCare onboarded it (commit 59620173). The target repository at version 2.3.18.Final-tuxcare.3 contains the complete fix in all TLS client code paths. The vulnerable pattern (missing hostname verification) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:59.702907+00:00",
      "status_notes": "Vulnerability CVE-2023-1108 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2023-1108 is not present in the target. The vulnerable infinite loop pattern in SslConduit.wrapAndFlip() was fixed by upstream commit ccc053b55 (authored by Flavia Rainone from Red Hat) which added the !engine.isInboundDone() check to the while loop condition. This fix was already included in the upstream Undertow 2.3.18.Final release that TuxCare onboarded, as verified by checking that the fix commit is an ancestor of the first TuxCare commit (59620173 - onboarding of 2.3.18.Final). The target code at core/src/main/java/io/undertow/protocols/ssl/SslConduit.java:1011 contains the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-1108"
      },
      "impact_statement": "CVE-2023-1108 is not present in the target. The vulnerable infinite loop pattern in SslConduit.wrapAndFlip() was fixed by upstream commit ccc053b55 (authored by Flavia Rainone from Red Hat) which added the !engine.isInboundDone() check to the while loop condition. This fix was already included in the upstream Undertow 2.3.18.Final release that TuxCare onboarded, as verified by checking that the fix commit is an ancestor of the first TuxCare commit (59620173 - onboarding of 2.3.18.Final). The target code at core/src/main/java/io/undertow/protocols/ssl/SslConduit.java:1011 contains the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:50:11.363618+00:00",
      "status_notes": "Vulnerability CVE-2023-1973 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2023-1973 fix is already present in Undertow 2.3.18.Final. The vulnerability allowed denial-of-service via memory exhaustion by creating many unauthenticated sessions with long timeouts. The upstream fix (commit 0410f3c4d by Richard Op\u00e1lka) limits new authentication sessions to 2-minute timeouts, preventing session accumulation. This fix was shipped in the upstream 2.3.18.Final release before TuxCare onboarding (commit 596201731), making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final), Snyk (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-1973"
      },
      "impact_statement": "CVE-2023-1973 fix is already present in Undertow 2.3.18.Final. The vulnerability allowed denial-of-service via memory exhaustion by creating many unauthenticated sessions with long timeouts. The upstream fix (commit 0410f3c4d by Richard Op\u00e1lka) limits new authentication sessions to 2-minute timeouts, preventing session accumulation. This fix was shipped in the upstream 2.3.18.Final release before TuxCare onboarding (commit 596201731), making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final), Snyk (< 2.2.32.Final; >= 2.3.0.Alpha1, < 2.3.13.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2023-4639 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2023-4639 affects Undertow's cookie parsing logic, allowing malformed quoted cookie values containing unescaped semicolons or commas to consume subsequent cookies, enabling exfiltration or spoofing. The upstream fix (commit 1f93a979d2) was already present in Undertow 2.3.18.Final when TuxCare onboarded it on 2026-03-31. The fix adds proper handling in the cookie parser's state machine to reject malformed quoted values by resetting parser state when encountering delimiters before the closing quote. Target is not affected as the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.11.Final; < 2.2.30.Final), Snyk (< 2.2.30.Final; >= 2.3.0.Alpha1, < 2.3.11.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-4639"
      },
      "impact_statement": "CVE-2023-4639 affects Undertow's cookie parsing logic, allowing malformed quoted cookie values containing unescaped semicolons or commas to consume subsequent cookies, enabling exfiltration or spoofing. The upstream fix (commit 1f93a979d2) was already present in Undertow 2.3.18.Final when TuxCare onboarded it on 2026-03-31. The fix adds proper handling in the cookie parser's state machine to reject malformed quoted values by resetting parser state when encountering delimiters before the closing quote. Target is not affected as the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.11.Final; < 2.2.30.Final), Snyk (< 2.2.30.Final; >= 2.3.0.Alpha1, < 2.3.11.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T01:49:00.101185+00:00",
      "status_notes": "Vulnerability CVE-2024-1459 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.3.18.Final-tuxcare.3) is NOT AFFECTED by CVE-2024-1459. The vulnerability fix was already present in the upstream release 2.3.18.Final that TuxCare onboarded. The fix commit (9b7c5037e by Tomas Hofman <thofman@redhat.com>) is an ancestor of the TuxCare onboarding commit (5962017), confirming the fix was shipped with the upstream release. Both components of the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-1459"
      },
      "impact_statement": "not_affected \u2014 The target repository (Undertow 2.3.18.Final-tuxcare.3) is NOT AFFECTED by CVE-2024-1459. The vulnerability fix was already present in the upstream release 2.3.18.Final that TuxCare onboarded. The fix commit (9b7c5037e by Tomas Hofman <thofman@redhat.com>) is an ancestor of the TuxCare onboarding commit (5962017), confirming the fix was shipped with the upstream release. Both components of the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:48:57.330318+00:00",
      "status_notes": "Vulnerability CVE-2024-1635 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2024-1635 is not present in undertow 2.3.18.Final-tuxcare.3. The vulnerability (resource leak in WriteTimeoutStreamSinkConduit when connections close during HTTP upgrade) was fixed by upstream in commit e824766df3b9d9614eff7700159e3aac5a35a1b8 (2024-01-08) and shipped in upstream release 2.3.18.Final. TuxCare onboarded this already-fixed version via commit 59620173182008f1c7364ac5596afc1357eea1c3. The fix includes: (1) close listener that removes timeout handle on connection close, (2) volatile handle field for thread safety, (3) synchronized blocks preventing race conditions during handle lifecycle management.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Final, < 2.3.12.Final; < 2.2.31.Final), cve.org (= 1.31.0), Snyk (< 2.2.31.Final; >= 2.3.0.Final, < 2.3.12.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-1635"
      },
      "impact_statement": "CVE-2024-1635 is not present in undertow 2.3.18.Final-tuxcare.3. The vulnerability (resource leak in WriteTimeoutStreamSinkConduit when connections close during HTTP upgrade) was fixed by upstream in commit e824766df3b9d9614eff7700159e3aac5a35a1b8 (2024-01-08) and shipped in upstream release 2.3.18.Final. TuxCare onboarded this already-fixed version via commit 59620173182008f1c7364ac5596afc1357eea1c3. The fix includes: (1) close listener that removes timeout handle on connection close, (2) volatile handle field for thread safety, (3) synchronized blocks preventing race conditions during handle lifecycle management.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Final, < 2.3.12.Final; < 2.2.31.Final), cve.org (= 1.31.0), Snyk (< 2.2.31.Final; >= 2.3.0.Final, < 2.3.12.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T23:33:00.189735+00:00",
      "status_notes": "Vulnerability CVE-2024-3653 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2024-3653 affects Undertow's LearningPushHandler when using unbounded HashMap structures for caching learned push resources, allowing memory exhaustion DoS. The target (Undertow 2.3.18.Final-tuxcare.3) is NOT AFFECTED because the vulnerability was fixed by upstream commit 6b8e79c167ed (author: baranowb@gmail.com) which shipped in the 2.3.18.Final release before TuxCare onboarding. The fix r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-3653"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-3653 affects Undertow's LearningPushHandler when using unbounded HashMap structures for caching learned push resources, allowing memory exhaustion DoS. The target (Undertow 2.3.18.Final-tuxcare.3) is NOT AFFECTED because the vulnerability was fixed by upstream commit 6b8e79c167ed (author: baranowb@gmail.com) which shipped in the 2.3.18.Final release before TuxCare onboarding. The fix r..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-3884 is fixed in version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core.",
      "vulnerability": {
        "name": "CVE-2024-3884"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-4027 is fixed in version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core.",
      "vulnerability": {
        "name": "CVE-2024-4027"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.3.18.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2024-4109"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2024-5971 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2024-5971 does not affect this version (2.3.18.Final) because the upstream fix was already included in the 2.3.18.Final release. The vulnerability involved incorrect byte accounting in SslConduit.wrapAndFlip() where only the last SSL wrap() call's consumed bytes were reported instead of the total across multiple iterations, causing chunked HTTP responses to hang without sending the final 0\\r\\n terminator. The fix (commit 1418733c99ff0a298161e13e4b0b00c913522e6f by Flavia Rainone from Red Hat) correctly tracks totalConsumedBytes across all wrap iterations and was shipped in the upstream release before TuxCare onboarded version 2.3.18.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.15.Final; < 2.2.34.Final), cve.org (< 2.2.34.Final; >= 2.3.0.Alpha1, < 2.3.15.Final), Snyk (< 2.2.34.Final; >= 2.3.0.Final, < 2.3.8.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-5971"
      },
      "impact_statement": "CVE-2024-5971 does not affect this version (2.3.18.Final) because the upstream fix was already included in the 2.3.18.Final release. The vulnerability involved incorrect byte accounting in SslConduit.wrapAndFlip() where only the last SSL wrap() call's consumed bytes were reported instead of the total across multiple iterations, causing chunked HTTP responses to hang without sending the final 0\\r\\n terminator. The fix (commit 1418733c99ff0a298161e13e4b0b00c913522e6f by Flavia Rainone from Red Hat) correctly tracks totalConsumedBytes across all wrap iterations and was shipped in the upstream release before TuxCare onboarded version 2.3.18.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.15.Final; < 2.2.34.Final), cve.org (< 2.2.34.Final; >= 2.3.0.Alpha1, < 2.3.15.Final), Snyk (< 2.2.34.Final; >= 2.3.0.Final, < 2.3.8.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:57:15.327260+00:00",
      "status_notes": "Vulnerability CVE-2024-6162 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. CVE-2024-6162 affects Undertow's AJP request parser where a shared `decodeBuffer` StringBuilder instance field caused path data to be mixed between concurrent requests. The upstream fix (commit 90f202ada by Red Hat engineer thofman@redhat.com) removed the shared instance field and replaced it with a local variable created fresh for each decode operation. This fix was already present in upstream release 2.3.18.Final before TuxCare onboarded it (commit 5962017, 66 commits after the fix). The target code at HEAD (2.3.18.Final-tuxcare.3) contains the fix: line 532 creates a local `final StringBuilder decodeBuffer = new StringBuilder();` and no instance field exists. The vulnerable pattern is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.14.Final; < 2.2.33.Final), cve.org (< 2.2.33.Final; >= 2.3.0.Alpha1, < 2.3.14), Snyk (< 2.2.33.Final; >= 2.3.0.Final, < 2.3.14.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6162"
      },
      "impact_statement": "CVE-2024-6162 affects Undertow's AJP request parser where a shared `decodeBuffer` StringBuilder instance field caused path data to be mixed between concurrent requests. The upstream fix (commit 90f202ada by Red Hat engineer thofman@redhat.com) removed the shared instance field and replaced it with a local variable created fresh for each decode operation. This fix was already present in upstream release 2.3.18.Final before TuxCare onboarded it (commit 5962017, 66 commits after the fix). The target code at HEAD (2.3.18.Final-tuxcare.3) contains the fix: line 532 creates a local `final StringBuilder decodeBuffer = new StringBuilder();` and no instance field exists. The vulnerable pattern is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0.Alpha1, < 2.3.14.Final; < 2.2.33.Final), cve.org (< 2.2.33.Final; >= 2.3.0.Alpha1, < 2.3.14), Snyk (< 2.2.33.Final; >= 2.3.0.Final, < 2.3.14.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:48:33.516993+00:00",
      "status_notes": "Vulnerability CVE-2024-7885 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. Prechecker: A change identical to the upstream fix is already in this version's source history. The upstream fix was released in 2.3.17.Final, and version 2.3.18.Final is a later release of the same line. Advisories: GitHub GHSA-9623-mqmm-5rcf (fixed in 2.3.17.Final), CVE record (fixed in 2.3.17.Final), Snyk (fixed in 2.3.17.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7885"
      },
      "impact_statement": "Prechecker: A change identical to the upstream fix is already in this version's source history. The upstream fix was released in 2.3.17.Final, and version 2.3.18.Final is a later release of the same line. Advisories: GitHub GHSA-9623-mqmm-5rcf (fixed in 2.3.17.Final), CVE record (fixed in 2.3.17.Final), Snyk (fixed in 2.3.17.Final)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-12543 is fixed in version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core.",
      "vulnerability": {
        "name": "CVE-2025-12543"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-9784 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core, and is fixed in 2.3.18.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-9784"
      },
      "action_statement": "Vulnerability CVE-2025-9784 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core, and is fixed in 2.3.18.Final-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T21:20:00.078709+00:00",
      "status_notes": "Vulnerability CVE-2026-28367 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. Version 2.3.18.Final is not vulnerable. Summary: The target repository (Undertow 2.3.18.Final) already contains all security fixes for CVE-2026-28367. The vulnerability that allowed using `\\r\\r\\r` as a header block terminator for request smuggling has been mitigated through multiple validation layers. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-28367"
      },
      "impact_statement": "Version 2.3.18.Final is not vulnerable. Summary: The target repository (Undertow 2.3.18.Final) already contains all security fixes for CVE-2026-28367. The vulnerability that allowed using `\\r\\r\\r` as a header block terminator for request smuggling has been mitigated through multiple validation layers. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T21:26:00.126687+00:00",
      "status_notes": "Vulnerability CVE-2026-28368 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. Version 2.3.18.Final is not vulnerable. Summary: The target repository (Undertow 2.3.18.Final) is NOT vulnerable to CVE-2026-28368. The security patch preventing HTTP request smuggling through header parsing validation was applied in commit 1e7264781 on March 30, 2017, well before the current version. All validation mechanisms described in the patch are present and active in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-28368"
      },
      "impact_statement": "Version 2.3.18.Final is not vulnerable. Summary: The target repository (Undertow 2.3.18.Final) is NOT vulnerable to CVE-2026-28368. The security patch preventing HTTP request smuggling through header parsing validation was applied in commit 1e7264781 on March 30, 2017, well before the current version. All validation mechanisms described in the patch are present and active in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T20:47:05.334467+00:00",
      "status_notes": "Vulnerability CVE-2026-28369 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core. Version 2.3.18.Final is not affected by CVE-2026-28369: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 80b34f852a3fb8fc39309773cc739d05187381d8\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2026-28369"
      },
      "impact_statement": "Version 2.3.18.Final is not affected by CVE-2026-28369: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 80b34f852a3fb8fc39309773cc739d05187381d8\". No backport needed."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.18.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-3260 is fixed in version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-core.",
      "vulnerability": {
        "name": "CVE-2026-3260"
      }
    }
  ]
}