{ "@id": "urn:uuid:39229c43-0b10-4d1c-93c6-3e97af885bb3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 18, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-01T04:16:00.095486+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2014-7816 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2014-7816" }, "action_statement": "Vulnerability CVE-2014-7816 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2016-7046 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2016-7046" }, "action_statement": "Vulnerability CVE-2016-7046 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-12165 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-12165" }, "action_statement": "Vulnerability CVE-2017-12165 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T23:46:00.189485+00:00", "status_notes": "Vulnerability CVE-2017-12196 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 Target is not affected by CVE-2017-12196. The vulnerability involved missing URI validation in Undertow's Digest authentication mechanism, allowing attackers to authenticate for one URI while accessing another (MITM attack). The fix, which validates that the digest-uri field in the Authorization header matches the actual HTTP request URI, was implemented by upstream Undertow developer Stuart Do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12196" }, "impact_statement": "not_affected \u2014 Target is not affected by CVE-2017-12196. The vulnerability involved missing URI validation in Undertow's Digest authentication mechanism, allowing attackers to authenticate for one URI while accessing another (MITM attack). The fix, which validates that the digest-uri field in the Authorization header matches the actual HTTP request URI, was implemented by upstream Undertow developer Stuart Do..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2666 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2666" }, "action_statement": "Vulnerability CVE-2017-2666 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2670 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2670" }, "action_statement": "Vulnerability CVE-2017-2670 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T10:52:10.332998+00:00", "status_notes": "Vulnerability CVE-2017-7559 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-7559" }, "action_statement": "Vulnerability CVE-2017-7559 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T00:19:00.148698+00:00", "status_notes": "Vulnerability CVE-2018-1114 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2018-1114 (file descriptor leak in URLResource.getLastModified() for jar URLs) does not affect target version 2.3.17.Final. The upstream fix (commit 882d5884f by Norito Agetsuma) was already present in upstream Undertow 2.3.17.Final before TuxCare onboarded it. The fix adds special handling for jar protocol URLs to avoid calling JarURLConnection.getLastModified(), which leaks file descripto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1114" }, "impact_statement": "not_affected \u2014 CVE-2018-1114 (file descriptor leak in URLResource.getLastModified() for jar URLs) does not affect target version 2.3.17.Final. The upstream fix (commit 882d5884f by Norito Agetsuma) was already present in upstream Undertow 2.3.17.Final before TuxCare onboarded it. The fix adds special handling for jar protocol URLs to avoid calling JarURLConnection.getLastModified(), which leaks file descripto..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T04:16:00.095486+00:00", "status_notes": "Vulnerability CVE-2018-14642 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2018-14642 (information leak via buffer over-write) is NOT present in target version 2.3.17.Final. The vulnerable code pattern was fixed by upstream commit a83b047d5 (Stuart Douglas, 2018-09-13) which changed `next.write(data, 0, data.length)` to `next.write(data, 0, length + 1)` in HttpResponseConduit.java line 157, limiting writes to populated buffer elements only. This fix was included i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14642" }, "impact_statement": "not_affected \u2014 CVE-2018-14642 (information leak via buffer over-write) is NOT present in target version 2.3.17.Final. The vulnerable code pattern was fixed by upstream commit a83b047d5 (Stuart Douglas, 2018-09-13) which changed `next.write(data, 0, data.length)` to `next.write(data, 0, length + 1)` in HttpResponseConduit.java line 157, limiting writes to populated buffer elements only. This fix was included i..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-10184 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10184" }, "action_statement": "Vulnerability CVE-2019-10184 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2019-10212 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10212" }, "action_statement": "Vulnerability CVE-2019-10212 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-14888 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-14888" }, "action_statement": "Vulnerability CVE-2019-14888 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-3888 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-3888" }, "action_statement": "Vulnerability CVE-2019-3888 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T03:26:00.144839+00:00", "status_notes": "Vulnerability CVE-2020-10687 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2020-10687 (HTTP request smuggling) is not present in Undertow 2.3.17.Final. All three upstream fix commits (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) were already included in the upstream 2.3.17.Final release before TuxCare onboarding. The fixes validate request characters, reject inappropriate whitespace (tabs/newlines/carriage returns in wrong positions, spaces in header names), and v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10687" }, "impact_statement": "not_affected \u2014 CVE-2020-10687 (HTTP request smuggling) is not present in Undertow 2.3.17.Final. All three upstream fix commits (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) were already included in the upstream 2.3.17.Final release before TuxCare onboarding. The fixes validate request characters, reject inappropriate whitespace (tabs/newlines/carriage returns in wrong positions, spaces in header names), and v..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-10705 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-10705" }, "action_statement": "Vulnerability CVE-2020-10705 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T02:32:36.583439+00:00", "status_notes": "Vulnerability CVE-2020-10719 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT AFFECTED by CVE-2020-10719. The vulnerability pattern (unbounded chunk-size accumulation leading to integer overflow and request smuggling) has been removed by an upstream fix that was already present in the 2.3.17.Final release that TuxCare onboarded. The fix was authored by Red Hat developers and shipped in the upstream release be...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10719" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT AFFECTED by CVE-2020-10719. The vulnerability pattern (unbounded chunk-size accumulation leading to integer overflow and request smuggling) has been removed by an upstream fix that was already present in the 2.3.17.Final release that TuxCare onboarded. The fix was authored by Red Hat developers and shipped in the upstream release be..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1745 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1745" }, "action_statement": "Vulnerability CVE-2020-1745 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1757 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1757" }, "action_statement": "Vulnerability CVE-2020-1757 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-27782 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-27782" }, "action_statement": "Vulnerability CVE-2020-27782 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T03:43:00.092700+00:00", "status_notes": "Vulnerability CVE-2021-20220 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 The target Undertow 2.3.17.Final is not affected by CVE-2021-20220. The vulnerability concerns HTTP request smuggling due to permitting invalid characters in HTTP requests (both HTTP/1.x and HTTP/2). The upstream fix (UNDERTOW-1780 and UNDERTOW-1774) adds comprehensive byte-level validation of HTTP/2 pseudo-headers (:path, :scheme, :authority, :method) and rejects whitespace in HTTP/1.x header ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20220" }, "impact_statement": "not_affected \u2014 The target Undertow 2.3.17.Final is not affected by CVE-2021-20220. The vulnerability concerns HTTP request smuggling due to permitting invalid characters in HTTP requests (both HTTP/1.x and HTTP/2). The upstream fix (UNDERTOW-1780 and UNDERTOW-1774) adds comprehensive byte-level validation of HTTP/2 pseudo-headers (:path, :scheme, :authority, :method) and rejects whitespace in HTTP/1.x header ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T23:38:00.240793+00:00", "status_notes": "Vulnerability CVE-2021-3597 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-3597 affects Undertow versions prior to 2.2.9.Final and 2.0.39.Final. The vulnerability involves AbstractFramedStreamSinkChannel.flushComplete() failing to requeue the final frame when buffer flushing leaves remaining data, causing streams to never close properly and resulting in denial of service. The target version 2.3.17.Final already contains the upstream fix (commit b92904715) whi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3597" }, "impact_statement": "not_affected \u2014 CVE-2021-3597 affects Undertow versions prior to 2.2.9.Final and 2.0.39.Final. The vulnerability involves AbstractFramedStreamSinkChannel.flushComplete() failing to requeue the final frame when buffer flushing leaves remaining data, causing streams to never close properly and resulting in denial of service. The target version 2.3.17.Final already contains the upstream fix (commit b92904715) whi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T00:10:00.106947+00:00", "status_notes": "Vulnerability CVE-2021-3629 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-3629 (HTTP/2 flow control DoS) is NOT present in Undertow 2.3.17.Final. The vulnerability involved indefinite blocking when waiting for HTTP/2 WINDOW_UPDATE frames from clients, allowing DoS through thread exhaustion. The upstream fix (UNDERTOW-1910, commit a4e7b1dbd) was already present in the 2.3.17.Final release that TuxCare onboarded, authored by Red Hat engineer frainone@redhat.co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3629" }, "impact_statement": "not_affected \u2014 CVE-2021-3629 (HTTP/2 flow control DoS) is NOT present in Undertow 2.3.17.Final. The vulnerability involved indefinite blocking when waiting for HTTP/2 WINDOW_UPDATE frames from clients, allowing DoS through thread exhaustion. The upstream fix (UNDERTOW-1910, commit a4e7b1dbd) was already present in the 2.3.17.Final release that TuxCare onboarded, authored by Red Hat engineer frainone@redhat.co..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3690 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3690" }, "action_statement": "Vulnerability CVE-2021-3690 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3859 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3859" }, "action_statement": "Vulnerability CVE-2021-3859 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2022-2053 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-2053" }, "action_statement": "Vulnerability CVE-2022-2053 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2022-4492 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-4492" }, "action_statement": "Vulnerability CVE-2022-4492 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1108 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1108" }, "action_statement": "Vulnerability CVE-2023-1108 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1973 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1973" }, "action_statement": "Vulnerability CVE-2023-1973 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-4639 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-4639" }, "action_statement": "Vulnerability CVE-2023-4639 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T01:49:00.101185+00:00", "status_notes": "Vulnerability CVE-2024-1459 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT affected by CVE-2024-1459. The vulnerability was fixed in upstream commits 9b7c5037e and 54f3e4325 by Red Hat developers (thofman@redhat.com, frainone@redhat.com), and these fixes were already included in upstream release 2.3.17.Final before TuxCare onboarded it. The fix prevents path traversal by preserving semicolons in dot-segmen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1459" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.3.17.Final-tuxcare.2) is NOT affected by CVE-2024-1459. The vulnerability was fixed in upstream commits 9b7c5037e and 54f3e4325 by Red Hat developers (thofman@redhat.com, frainone@redhat.com), and these fixes were already included in upstream release 2.3.17.Final before TuxCare onboarded it. The fix prevents path traversal by preserving semicolons in dot-segmen..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-1635 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-1635" }, "action_statement": "Vulnerability CVE-2024-1635 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T23:32:00.169654+00:00", "status_notes": "Vulnerability CVE-2024-3653 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2024-3653 affects Undertow's LearningPushHandler which previously used unbounded HashMap storage for nested caches, allowing memory exhaustion via crafted HTTP requests with varying Referer headers. The target version 2.3.17.Final ships with upstream commits 6b8e79c16 and a03e5189b already applied, which replace unbounded HashMaps with bounded LRUCache instances enforcing size and age limit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3653" }, "impact_statement": "not_affected \u2014 CVE-2024-3653 affects Undertow's LearningPushHandler which previously used unbounded HashMap storage for nested caches, allowing memory exhaustion via crafted HTTP requests with varying Referer headers. The target version 2.3.17.Final ships with upstream commits 6b8e79c16 and a03e5189b already applied, which replace unbounded HashMaps with bounded LRUCache instances enforcing size and age limit..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3884 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-3884" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4027 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-4027" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-examples 2.3.17.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2024-4109" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-5971 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-5971" }, "action_statement": "Vulnerability CVE-2024-5971 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2024-6162 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-6162" }, "action_statement": "Vulnerability CVE-2024-6162 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-7885 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-7885" }, "action_statement": "Vulnerability CVE-2024-7885 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12543 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-12543" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-9784 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-9784" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.17.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3260 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2026-3260" }, "action_statement": "Vulnerability CVE-2026-3260 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-examples." } ] }