{ "@id": "urn:uuid:a3207e87-6403-49d1-b129-381274127dd0", "role": "Document Creator", "author": "https://tuxcare.com", "version": 18, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-01T04:15:00.311363+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2014-7816 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2014-7816" }, "action_statement": "Vulnerability CVE-2014-7816 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2016-7046 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2016-7046" }, "action_statement": "Vulnerability CVE-2016-7046 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-12165 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-12165" }, "action_statement": "Vulnerability CVE-2017-12165 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T23:44:00.212234+00:00", "status_notes": "Vulnerability CVE-2017-12196 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2017-12196 is NOT present in this target. The vulnerability fix was already included in the upstream Undertow 2.3.18.Final release. The DigestAuthenticationMechanism.java file contains the complete URI validation logic (lines 235-259) that prevents the MITM attack by ensuring the URI in the Digest Authorization header matches the actual HTTP request URI. This fix was authored by Stuart Doug...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12196" }, "impact_statement": "not_affected \u2014 CVE-2017-12196 is NOT present in this target. The vulnerability fix was already included in the upstream Undertow 2.3.18.Final release. The DigestAuthenticationMechanism.java file contains the complete URI validation logic (lines 235-259) that prevents the MITM attack by ensuring the URI in the Digest Authorization header matches the actual HTTP request URI. This fix was authored by Stuart Doug..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2666 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2666" }, "action_statement": "Vulnerability CVE-2017-2666 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2670 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2670" }, "action_statement": "Vulnerability CVE-2017-2670 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T10:52:10.332998+00:00", "status_notes": "Vulnerability CVE-2017-7559 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-7559" }, "action_statement": "Vulnerability CVE-2017-7559 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T00:17:00.126158+00:00", "status_notes": "Vulnerability CVE-2018-1114 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2018-1114 describes a file descriptor leak in URLResource.getLastModified() when handling JAR URLs. The vulnerable pattern called URLConnection.getLastModified() on JarURLConnection objects with caching enabled, causing file descriptors to remain open until finalization. The target repository version 2.3.18.Final already contains the upstream fix (commit 882d5884f from April 2018) that disa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1114" }, "impact_statement": "not_affected \u2014 CVE-2018-1114 describes a file descriptor leak in URLResource.getLastModified() when handling JAR URLs. The vulnerable pattern called URLConnection.getLastModified() on JarURLConnection objects with caching enabled, causing file descriptors to remain open until finalization. The target repository version 2.3.18.Final already contains the upstream fix (commit 882d5884f from April 2018) that disa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T04:15:00.311363+00:00", "status_notes": "Vulnerability CVE-2018-14642 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 The target Undertow 2.3.18.Final is NOT affected by CVE-2018-14642. The vulnerability involved an information leak where HttpResponseConduit.java would write the entire buffer array length instead of only the valid data length, potentially exposing data from previous requests. The upstream fix (commit a83b047d5 by Stuart Douglas, dated 2018-09-13) changed `next.write(data, 0, data.length)` to `...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14642" }, "impact_statement": "not_affected \u2014 The target Undertow 2.3.18.Final is NOT affected by CVE-2018-14642. The vulnerability involved an information leak where HttpResponseConduit.java would write the entire buffer array length instead of only the valid data length, potentially exposing data from previous requests. The upstream fix (commit a83b047d5 by Stuart Douglas, dated 2018-09-13) changed `next.write(data, 0, data.length)` to `..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-10184 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10184" }, "action_statement": "Vulnerability CVE-2019-10184 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2019-10212 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10212" }, "action_statement": "Vulnerability CVE-2019-10212 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-14888 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-14888" }, "action_statement": "Vulnerability CVE-2019-14888 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-3888 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-3888" }, "action_statement": "Vulnerability CVE-2019-3888 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T03:24:00.109850+00:00", "status_notes": "Vulnerability CVE-2020-10687 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2020-10687 (HTTP request smuggling via invalid characters) is NOT present in Undertow 2.3.18.Final-tuxcare.3. The upstream vendor fixes (UNDERTOW-1780 a18574a4d and UNDERTOW-1165 3436b03ed) were already shipped in the upstream 2.3.18.Final release that TuxCare onboarded. These fixes add strict character validation to prevent protocol boundary confusion: (1) HTTP/2 pseudo-header validation u...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10687" }, "impact_statement": "not_affected \u2014 CVE-2020-10687 (HTTP request smuggling via invalid characters) is NOT present in Undertow 2.3.18.Final-tuxcare.3. The upstream vendor fixes (UNDERTOW-1780 a18574a4d and UNDERTOW-1165 3436b03ed) were already shipped in the upstream 2.3.18.Final release that TuxCare onboarded. These fixes add strict character validation to prevent protocol boundary confusion: (1) HTTP/2 pseudo-header validation u..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-10705 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-10705" }, "action_statement": "Vulnerability CVE-2020-10705 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T02:29:00.231467+00:00", "status_notes": "Vulnerability CVE-2020-10719 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2020-10719 is NOT present in the target. The vulnerability involved integer overflow in HTTP chunked transfer-encoding chunk size parsing, which could lead to HTTP request smuggling. The upstream vendor fix (commit bfc8fbd67) was already included in Undertow 2.3.18.Final before TuxCare onboarding. The fix adds a LIMIT constant (Long.MAX_VALUE >> 4) and validates the accumulated chunk size b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10719" }, "impact_statement": "not_affected \u2014 CVE-2020-10719 is NOT present in the target. The vulnerability involved integer overflow in HTTP chunked transfer-encoding chunk size parsing, which could lead to HTTP request smuggling. The upstream vendor fix (commit bfc8fbd67) was already included in Undertow 2.3.18.Final before TuxCare onboarding. The fix adds a LIMIT constant (Long.MAX_VALUE >> 4) and validates the accumulated chunk size b..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1745 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1745" }, "action_statement": "Vulnerability CVE-2020-1745 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1757 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1757" }, "action_statement": "Vulnerability CVE-2020-1757 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-27782 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-27782" }, "action_statement": "Vulnerability CVE-2020-27782 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T03:42:00.114565+00:00", "status_notes": "Vulnerability CVE-2021-20220 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 The target (Undertow 2.3.18.Final-tuxcare.3) is not affected by CVE-2021-20220. The vulnerability involves HTTP request smuggling through invalid characters in HTTP/2 pseudo-headers and HTTP/1.x header field names. All required fixes (UNDERTOW-1780 for HTTP/2 pseudo-header validation, UNDERTOW-1774 for whitespace handling) were included in the upstream 2.3.18.Final release before TuxCare onboar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20220" }, "impact_statement": "not_affected \u2014 The target (Undertow 2.3.18.Final-tuxcare.3) is not affected by CVE-2021-20220. The vulnerability involves HTTP request smuggling through invalid characters in HTTP/2 pseudo-headers and HTTP/1.x header field names. All required fixes (UNDERTOW-1780 for HTTP/2 pseudo-header validation, UNDERTOW-1774 for whitespace handling) were included in the upstream 2.3.18.Final release before TuxCare onboar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T23:36:00.286721+00:00", "status_notes": "Vulnerability CVE-2021-3597 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-3597 is NOT present in the target. The vulnerability (UNDERTOW-1842) affected AbstractFramedStreamSinkChannel.flushComplete() where the final frame was not requeued when flush completed with remaining unflushed data, causing denial of service through incomplete stream closure. The fix (commit b92904715c5f5857827cf4201b9bce5844919259) was already present in upstream release 2.3.18.Final...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3597" }, "impact_statement": "not_affected \u2014 CVE-2021-3597 is NOT present in the target. The vulnerability (UNDERTOW-1842) affected AbstractFramedStreamSinkChannel.flushComplete() where the final frame was not requeued when flush completed with remaining unflushed data, causing denial of service through incomplete stream closure. The fix (commit b92904715c5f5857827cf4201b9bce5844919259) was already present in upstream release 2.3.18.Final..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T00:07:00.112617+00:00", "status_notes": "Vulnerability CVE-2021-3629 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-3629 (HTTP/2 flow control DoS via indefinite blocking) is NOT present in this target. The upstream fix (UNDERTOW-1910) shipped in Undertow 2.3.18.Final, which TuxCare onboarded. The vulnerable pattern (indefinite wait when peer withholds WINDOW_UPDATE frames) has been replaced with a timeout-based wait mechanism in AbstractFramedStreamSinkChannel.awaitWritable().", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3629" }, "impact_statement": "not_affected \u2014 CVE-2021-3629 (HTTP/2 flow control DoS via indefinite blocking) is NOT present in this target. The upstream fix (UNDERTOW-1910) shipped in Undertow 2.3.18.Final, which TuxCare onboarded. The vulnerable pattern (indefinite wait when peer withholds WINDOW_UPDATE frames) has been replaced with a timeout-based wait mechanism in AbstractFramedStreamSinkChannel.awaitWritable()." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3690 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3690" }, "action_statement": "Vulnerability CVE-2021-3690 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3859 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3859" }, "action_statement": "Vulnerability CVE-2021-3859 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2022-2053 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-2053" }, "action_statement": "Vulnerability CVE-2022-2053 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2022-4492 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-4492" }, "action_statement": "Vulnerability CVE-2022-4492 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1108 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1108" }, "action_statement": "Vulnerability CVE-2023-1108 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1973 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1973" }, "action_statement": "Vulnerability CVE-2023-1973 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-4639 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-4639" }, "action_statement": "Vulnerability CVE-2023-4639 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T01:49:00.101185+00:00", "status_notes": "Vulnerability CVE-2024-1459 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 The target repository (Undertow 2.3.18.Final-tuxcare.3) is NOT AFFECTED by CVE-2024-1459. The vulnerability fix was already present in the upstream release 2.3.18.Final that TuxCare onboarded. The fix commit (9b7c5037e by Tomas Hofman ) is an ancestor of the TuxCare onboarding commit (5962017), confirming the fix was shipped with the upstream release. Both components of the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1459" }, "impact_statement": "not_affected \u2014 The target repository (Undertow 2.3.18.Final-tuxcare.3) is NOT AFFECTED by CVE-2024-1459. The vulnerability fix was already present in the upstream release 2.3.18.Final that TuxCare onboarded. The fix commit (9b7c5037e by Tomas Hofman ) is an ancestor of the TuxCare onboarding commit (5962017), confirming the fix was shipped with the upstream release. Both components of the ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-1635 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-1635" }, "action_statement": "Vulnerability CVE-2024-1635 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T23:33:00.189735+00:00", "status_notes": "Vulnerability CVE-2024-3653 does not affect version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2024-3653 affects Undertow's LearningPushHandler when using unbounded HashMap structures for caching learned push resources, allowing memory exhaustion DoS. The target (Undertow 2.3.18.Final-tuxcare.3) is NOT AFFECTED because the vulnerability was fixed by upstream commit 6b8e79c167ed (author: baranowb@gmail.com) which shipped in the 2.3.18.Final release before TuxCare onboarding. The fix r...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3653" }, "impact_statement": "not_affected \u2014 CVE-2024-3653 affects Undertow's LearningPushHandler when using unbounded HashMap structures for caching learned push resources, allowing memory exhaustion DoS. The target (Undertow 2.3.18.Final-tuxcare.3) is NOT AFFECTED because the vulnerability was fixed by upstream commit 6b8e79c167ed (author: baranowb@gmail.com) which shipped in the 2.3.18.Final release before TuxCare onboarding. The fix r..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3884 is fixed in version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-3884" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4027 is fixed in version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-4027" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-examples 2.3.18.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2024-4109" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-5971 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-5971" }, "action_statement": "Vulnerability CVE-2024-5971 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2024-6162 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-6162" }, "action_statement": "Vulnerability CVE-2024-6162 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-7885 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-7885" }, "action_statement": "Vulnerability CVE-2024-7885 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12543 is fixed in version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-12543" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-9784 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples, and is fixed in 2.3.18.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2025-9784" }, "action_statement": "Vulnerability CVE-2025-9784 affects version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples, and is fixed in 2.3.18.Final-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.18.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3260 is fixed in version 2.3.18.Final-tuxcare.2 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2026-3260" } } ] }