{ "@id": "urn:uuid:60020bf1-d731-4937-ac02-732057e1845d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-01T04:15:00.311363+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2014-7816 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2014-7816" }, "action_statement": "Vulnerability CVE-2014-7816 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2016-7046 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2016-7046" }, "action_statement": "Vulnerability CVE-2016-7046 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-12165 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-12165" }, "action_statement": "Vulnerability CVE-2017-12165 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-31T23:43:00.211995+00:00", "status_notes": "Vulnerability CVE-2017-12196 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 CVE-2017-12196 describes a vulnerability in Undertow's Digest authentication where the server does not validate that the URI in the Authorization header matches the URI in the HTTP request line, allowing MITM attacks. The target version 2.2.37.Final at SHA c85edf915 is NOT AFFECTED because the upstream fix was already present in the release when TuxCare onboarded it. The fix (commits facb33a5c ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12196" }, "impact_statement": "not_affected \u2014 CVE-2017-12196 describes a vulnerability in Undertow's Digest authentication where the server does not validate that the URI in the Authorization header matches the URI in the HTTP request line, allowing MITM attacks. The target version 2.2.37.Final at SHA c85edf915 is NOT AFFECTED because the upstream fix was already present in the release when TuxCare onboarded it. The fix (commits facb33a5c ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2666 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2666" }, "action_statement": "Vulnerability CVE-2017-2666 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2670 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2670" }, "action_statement": "Vulnerability CVE-2017-2670 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-29T10:52:10.332998+00:00", "status_notes": "Vulnerability CVE-2017-7559 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-7559" }, "action_statement": "Vulnerability CVE-2017-7559 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-11-01T00:17:00.126158+00:00", "status_notes": "Vulnerability CVE-2018-1114 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 The target is not affected by CVE-2018-1114. The vulnerability (file descriptor leak in URLResource.getLastModified() when handling JAR URLs) was fixed by the upstream Undertow project in commit 882d5884f, which was already present in the 2.2.37.Final release before TuxCare onboarding. The fix code is present in URLResource.java lines 92-98, where jar protocol URLs now use File.lastModified() i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1114" }, "impact_statement": "not_affected \u2014 The target is not affected by CVE-2018-1114. The vulnerability (file descriptor leak in URLResource.getLastModified() when handling JAR URLs) was fixed by the upstream Undertow project in commit 882d5884f, which was already present in the 2.2.37.Final release before TuxCare onboarding. The fix code is present in URLResource.java lines 92-98, where jar protocol URLs now use File.lastModified() i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-11-01T04:15:00.311363+00:00", "status_notes": "Vulnerability CVE-2018-14642 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 CVE-2018-14642 is not present in target version 2.2.37.Final. The vulnerability was an information leak in HttpResponseConduit.java where stale buffer data from previous HTTP requests could be transmitted to clients due to writing data.length instead of length+1 bytes. The fix (UNDERTOW-1412) by Stuart Douglas was applied on Sep 13, 2018, changing line 146 from 'res = next.write(data, 0, data.l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14642" }, "impact_statement": "not_affected \u2014 CVE-2018-14642 is not present in target version 2.2.37.Final. The vulnerability was an information leak in HttpResponseConduit.java where stale buffer data from previous HTTP requests could be transmitted to clients due to writing data.length instead of length+1 bytes. The fix (UNDERTOW-1412) by Stuart Douglas was applied on Sep 13, 2018, changing line 146 from 'res = next.write(data, 0, data.l..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-10184 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10184" }, "action_statement": "Vulnerability CVE-2019-10184 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2019-10212 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10212" }, "action_statement": "Vulnerability CVE-2019-10212 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-14888 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-14888" }, "action_statement": "Vulnerability CVE-2019-14888 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-3888 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-3888" }, "action_statement": "Vulnerability CVE-2019-3888 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-11-01T03:23:00.071214+00:00", "status_notes": "Vulnerability CVE-2020-10687 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 CVE-2020-10687 concerns HTTP request smuggling via invalid characters in HTTP requests (tabs, newlines, forbidden bytes in request-line components). The target Undertow 2.2.37.Final already contains all relevant security fixes: (1) HTTP/1.x character validation in query/path parameters (UNDERTOW-1165, commit 3436b03ed from 2017-08-04), (2) HTTP/2 pseudo-header validation for :path/:scheme/:auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10687" }, "impact_statement": "not_affected \u2014 CVE-2020-10687 concerns HTTP request smuggling via invalid characters in HTTP requests (tabs, newlines, forbidden bytes in request-line components). The target Undertow 2.2.37.Final already contains all relevant security fixes: (1) HTTP/1.x character validation in query/path parameters (UNDERTOW-1165, commit 3436b03ed from 2017-08-04), (2) HTTP/2 pseudo-header validation for :path/:scheme/:auth..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-10705 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-10705" }, "action_statement": "Vulnerability CVE-2020-10705 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-11-01T02:29:00.231467+00:00", "status_notes": "Vulnerability CVE-2020-10719 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 The target repository (Undertow 2.2.37.Final) is not affected by CVE-2020-10719. The upstream vendor (Red Hat) fixed the integer overflow vulnerability in commit bfc8fbd67f6b3dd96702b363f61cf805baf3c6cf, which shipped in the upstream release 2.2.37.Final that TuxCare onboarded. The fix validates chunk size before left-shift operations to prevent overflow during chunked transfer encoding parsing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10719" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.2.37.Final) is not affected by CVE-2020-10719. The upstream vendor (Red Hat) fixed the integer overflow vulnerability in commit bfc8fbd67f6b3dd96702b363f61cf805baf3c6cf, which shipped in the upstream release 2.2.37.Final that TuxCare onboarded. The fix validates chunk size before left-shift operations to prevent overflow during chunked transfer encoding parsing..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1745 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1745" }, "action_statement": "Vulnerability CVE-2020-1745 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1757 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1757" }, "action_statement": "Vulnerability CVE-2020-1757 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-27782 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-27782" }, "action_statement": "Vulnerability CVE-2020-27782 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-11-01T03:40:02.616693+00:00", "status_notes": "Vulnerability CVE-2021-20220 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 The target repository (Undertow 2.2.37.Final) is not vulnerable to CVE-2021-20220. The vulnerability fixes were already present in the upstream release that TuxCare onboarded. The upstream fix commit a18574a4da09449d855c0a7e58dfca3e9e2e488e (authored by bspyrkos@redhat.com) added character validation for HTTP/2 pseudo-headers and was included in the base 2.2.37.Final release before TuxCare's ma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20220" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.2.37.Final) is not vulnerable to CVE-2021-20220. The vulnerability fixes were already present in the upstream release that TuxCare onboarded. The upstream fix commit a18574a4da09449d855c0a7e58dfca3e9e2e488e (authored by bspyrkos@redhat.com) added character validation for HTTP/2 pseudo-headers and was included in the base 2.2.37.Final release before TuxCare's ma..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-31T23:34:00.095788+00:00", "status_notes": "Vulnerability CVE-2021-3597 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-3597 is not present in Undertow 2.2.37.Final. The vulnerability (UNDERTOW-1842) involved AbstractFramedStreamSinkChannel.flushComplete() failing to requeue the final frame when remaining header data existed, causing HTTP/2 connections to hang. The upstream fix by Flavia Rainone (commit b92904715) was already included in the 2.2.37.Final release that TuxCare onboarded, prior to any TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3597" }, "impact_statement": "not_affected \u2014 CVE-2021-3597 is not present in Undertow 2.2.37.Final. The vulnerability (UNDERTOW-1842) involved AbstractFramedStreamSinkChannel.flushComplete() failing to requeue the final frame when remaining header data existed, causing HTTP/2 connections to hang. The upstream fix by Flavia Rainone (commit b92904715) was already included in the 2.2.37.Final release that TuxCare onboarded, prior to any TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-11-01T00:06:00.104799+00:00", "status_notes": "Vulnerability CVE-2021-3629 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-3629 is not present in Undertow 2.2.37.Final because the upstream vendor fix (UNDERTOW-1910) was already included in this release. The vulnerability involved HTTP/2 flow control handling where a malicious peer could exhaust server resources by withholding WINDOW_UPDATE frames, causing worker threads to block indefinitely. The fix adds a configurable timeout (default 600 seconds) to the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3629" }, "impact_statement": "not_affected \u2014 CVE-2021-3629 is not present in Undertow 2.2.37.Final because the upstream vendor fix (UNDERTOW-1910) was already included in this release. The vulnerability involved HTTP/2 flow control handling where a malicious peer could exhaust server resources by withholding WINDOW_UPDATE frames, causing worker threads to block indefinitely. The fix adds a configurable timeout (default 600 seconds) to the..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3690 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3690" }, "action_statement": "Vulnerability CVE-2021-3690 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3859 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3859" }, "action_statement": "Vulnerability CVE-2021-3859 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2022-2053 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-2053" }, "action_statement": "Vulnerability CVE-2022-2053 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2022-4492 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-4492" }, "action_statement": "Vulnerability CVE-2022-4492 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1108 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1108" }, "action_statement": "Vulnerability CVE-2023-1108 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1973 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1973" }, "action_statement": "Vulnerability CVE-2023-1973 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-4639 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-4639" }, "action_statement": "Vulnerability CVE-2023-4639 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-11-01T01:48:00.122313+00:00", "status_notes": "Vulnerability CVE-2024-1459 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 CVE-2024-1459 (path traversal via \"/..;\" segment) is NOT present in target version 2.2.37.Final. The upstream fix (commit 40bb3314f013247af8e222870bd5045ca8650c5c by Red Hat) was already included in the upstream release 2.2.37.Final when TuxCare onboarded it. The fix adds pathSubState tracking to prevent semicolons within dot-segments from being stripped, ensuring \"/..;\" is NOT treated as \"/..\"...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1459" }, "impact_statement": "not_affected \u2014 CVE-2024-1459 (path traversal via \"/..;\" segment) is NOT present in target version 2.2.37.Final. The upstream fix (commit 40bb3314f013247af8e222870bd5045ca8650c5c by Red Hat) was already included in the upstream release 2.2.37.Final when TuxCare onboarded it. The fix adds pathSubState tracking to prevent semicolons within dot-segments from being stripped, ensuring \"/..;\" is NOT treated as \"/..\"..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-1635 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-1635" }, "action_statement": "Vulnerability CVE-2024-1635 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3653 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 Target is Undertow 2.2.37.Final (TuxCare ELS branch 2.2.37.Final.tuxcare, HEAD c85edf915). CVE-2024-3653 is a remote memory-exhaustion DoS in LearningPushHandler: the pre-fix handler stored learned push resources in unbounded maps, so an attacker sending normal HTTP requests with many distinct paths/referrers could grow the cache without limit (default maxAge=-1 meant entries never expired and nothing capped the entry count). The upstream fix (UNDERTOW-2382) replaces the unbounded map with a bounded LRUCache> (default 200 entries) and makes max-entries/max-age configurable via system properties. This fix is ALREADY PRESENT in HEAD: LearningPushHandler.java:49-52,66,73 construct the bounded LRUCache, and LRUCache.add() (LRUCache.java:101-107) evicts the least-recently-used entry whenever cache.size() > maxEntries \u2014 bounding memory regardless of maxAge=-1. The fix commits 6d674f068 and 1da86edbd are ancestors of HEAD and, critically, ancestors of the upstream release base 4d04ea707 \"Prepare 2.2.37.Final\". They are authored by upstream maintainers (frainone@redhat.com, baranowb@gmail.com), NOT TuxCare. The TuxCare merge in HEAD (JAVAELSCVE-838) only edited core/pom.xml and did not touch the handler. Therefore the vulnerable pattern is not present; this is an upstream fix inherited from the shipped release \u2192 not_affected / code_not_present (not already_fixed, since no TuxCare-authored backport installed it). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3653" }, "impact_statement": "not_affected \u2014 Target is Undertow 2.2.37.Final (TuxCare ELS branch 2.2.37.Final.tuxcare, HEAD c85edf915). CVE-2024-3653 is a remote memory-exhaustion DoS in LearningPushHandler: the pre-fix handler stored learned push resources in unbounded maps, so an attacker sending normal HTTP requests with many distinct paths/referrers could grow the cache without limit (default maxAge=-1 meant entries never expired and nothing capped the entry count). The upstream fix (UNDERTOW-2382) replaces the unbounded map with a bounded LRUCache> (default 200 entries) and makes max-entries/max-age configurable via system properties. This fix is ALREADY PRESENT in HEAD: LearningPushHandler.java:49-52,66,73 construct the bounded LRUCache, and LRUCache.add() (LRUCache.java:101-107) evicts the least-recently-used entry whenever cache.size() > maxEntries \u2014 bounding memory regardless of maxAge=-1. The fix commits 6d674f068 and 1da86edbd are ancestors of HEAD and, critically, ancestors of the upstream release base 4d04ea707 \"Prepare 2.2.37.Final\". They are authored by upstream maintainers (frainone@redhat.com, baranowb@gmail.com), NOT TuxCare. The TuxCare merge in HEAD (JAVAELSCVE-838) only edited core/pom.xml and did not touch the handler. Therefore the vulnerable pattern is not present; this is an upstream fix inherited from the shipped release \u2192 not_affected / code_not_present (not already_fixed, since no TuxCare-authored backport installed it). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3884 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-3884" }, "action_statement": "Vulnerability CVE-2024-3884 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4027 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-4027" }, "action_statement": "Vulnerability CVE-2024-4027 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-examples 2.2.37.Final.tuxcare.", "vulnerability": { "name": "CVE-2024-4109" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-5971 does not affect version 2.2.37.Final.tuxcare of io.undertow:undertow-examples. not_affected \u2014 Target Undertow 2.2.37.Final already contains the upstream fix for CVE-2024-5971. The vulnerability is a chunked-response hang: in SslConduit.wrapAndFlip() the SSLEngine.wrap loop could run multiple iterations (handshake-interleaved wraps, notably Java 17 TLSv1.3), but only the LAST iteration's SSLEngineResult was returned. Its bytesConsumed() under-reported the total application bytes actually consumed, so the write layer believed the body was not fully written and never emitted the chunked 0\\r\\n terminator \u2014 the connection hangs, causing uncontrolled resource consumption / DoS. The fix accumulates totalConsumedBytes across all wrap iterations and, if the final result's bytesConsumed differs, reconstructs the SSLEngineResult with the correct total so the write completes and the response terminates. HEAD's SslConduit.java (lines ~1002-1019) contains this fix verbatim. The fix commit 6742d8333 (\"[UNDERTOW-2413] CVE-2024-5971 ...\") is authored by Flavia Rainone , a cherry-pick of upstream GitHub commit 74fdf630, and is an ancestor of the upstream \"Prepare 2.2.37.Final\" tag \u2014 i.e. shipped by upstream Red Hat before TuxCare onboarded the version. Verdict: not_affected (upstream/vendor fix already baked in), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-5971" }, "impact_statement": "not_affected \u2014 Target Undertow 2.2.37.Final already contains the upstream fix for CVE-2024-5971. The vulnerability is a chunked-response hang: in SslConduit.wrapAndFlip() the SSLEngine.wrap loop could run multiple iterations (handshake-interleaved wraps, notably Java 17 TLSv1.3), but only the LAST iteration's SSLEngineResult was returned. Its bytesConsumed() under-reported the total application bytes actually consumed, so the write layer believed the body was not fully written and never emitted the chunked 0\\r\\n terminator \u2014 the connection hangs, causing uncontrolled resource consumption / DoS. The fix accumulates totalConsumedBytes across all wrap iterations and, if the final result's bytesConsumed differs, reconstructs the SSLEngineResult with the correct total so the write completes and the response terminates. HEAD's SslConduit.java (lines ~1002-1019) contains this fix verbatim. The fix commit 6742d8333 (\"[UNDERTOW-2413] CVE-2024-5971 ...\") is authored by Flavia Rainone , a cherry-pick of upstream GitHub commit 74fdf630, and is an ancestor of the upstream \"Prepare 2.2.37.Final\" tag \u2014 i.e. shipped by upstream Red Hat before TuxCare onboarded the version. Verdict: not_affected (upstream/vendor fix already baked in), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2024-6162 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-6162" }, "action_statement": "Vulnerability CVE-2024-6162 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-7885 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-7885" }, "action_statement": "Vulnerability CVE-2024-7885 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12543 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-12543" }, "action_statement": "Vulnerability CVE-2025-12543 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-9784 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-9784" }, "action_statement": "Vulnerability CVE-2025-9784 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.2.37.Final.tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3260 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2026-3260" }, "action_statement": "Vulnerability CVE-2026-3260 affects version 2.2.37.Final.tuxcare of io.undertow:undertow-examples." } ] }