{ "@id": "urn:uuid:6a853196-75e1-4782-b612-300e86578241", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-01T04:19:00.130470+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2014-7816 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2014-7816" }, "action_statement": "Vulnerability CVE-2014-7816 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2016-7046 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2016-7046" }, "action_statement": "Vulnerability CVE-2016-7046 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-12165 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-12165" }, "action_statement": "Vulnerability CVE-2017-12165 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T23:48:00.112913+00:00", "status_notes": "Vulnerability CVE-2017-12196 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2017-12196 is NOT present in Undertow 2.3.24.Final. The vulnerability concerned missing URI validation in Digest authentication, allowing MITM attacks via URI mismatch between the Authorization header and HTTP request line. The upstream vendor (Stuart Douglas) fixed this via commits facb33a5c and 8804170c, which add comprehensive URI validation (both relative and absolute forms) to DigestAu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12196" }, "impact_statement": "not_affected \u2014 CVE-2017-12196 is NOT present in Undertow 2.3.24.Final. The vulnerability concerned missing URI validation in Digest authentication, allowing MITM attacks via URI mismatch between the Authorization header and HTTP request line. The upstream vendor (Stuart Douglas) fixed this via commits facb33a5c and 8804170c, which add comprehensive URI validation (both relative and absolute forms) to DigestAu..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2666 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2666" }, "action_statement": "Vulnerability CVE-2017-2666 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2017-2670 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-2670" }, "action_statement": "Vulnerability CVE-2017-2670 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:52:10.332998+00:00", "status_notes": "Vulnerability CVE-2017-7559 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2017-7559" }, "action_statement": "Vulnerability CVE-2017-7559 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T00:21:00.088051+00:00", "status_notes": "Vulnerability CVE-2018-1114 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2018-1114 describes a file descriptor leak in URLResource.getLastModified() when handling JAR URLs. The vulnerability occurs when calling connection.getLastModified() on JarURLConnection objects, which opens file descriptors that are only closed on finalization. The fix was applied upstream in commit 882d5884f (April 2018) by Norito Agetsuma, 8 years before the 2.3.24.Final release. The vul...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1114" }, "impact_statement": "not_affected \u2014 CVE-2018-1114 describes a file descriptor leak in URLResource.getLastModified() when handling JAR URLs. The vulnerability occurs when calling connection.getLastModified() on JarURLConnection objects, which opens file descriptors that are only closed on finalization. The fix was applied upstream in commit 882d5884f (April 2018) by Norito Agetsuma, 8 years before the 2.3.24.Final release. The vul..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T04:19:00.130470+00:00", "status_notes": "Vulnerability CVE-2018-14642 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2018-14642 is not present in Undertow 2.3.24.Final. The vulnerability involved writing more bytes than were populated in a buffer array (using data.length instead of the actual populated count), potentially leaking stale data from previous requests. The fix (commit a83b047d5) was shipped in upstream release 2.3.24.Final and changes line 157 of HttpResponseConduit.java from `next.write(data,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14642" }, "impact_statement": "not_affected \u2014 CVE-2018-14642 is not present in Undertow 2.3.24.Final. The vulnerability involved writing more bytes than were populated in a buffer array (using data.length instead of the actual populated count), potentially leaking stale data from previous requests. The fix (commit a83b047d5) was shipped in upstream release 2.3.24.Final and changes line 157 of HttpResponseConduit.java from `next.write(data,..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-10184 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10184" }, "action_statement": "Vulnerability CVE-2019-10184 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-10212 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-10212" }, "action_statement": "Vulnerability CVE-2019-10212 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-14888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-14888" }, "action_statement": "Vulnerability CVE-2019-14888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2019-3888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2019-3888" }, "action_statement": "Vulnerability CVE-2019-3888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T03:30:18.456848+00:00", "status_notes": "Vulnerability CVE-2020-10687 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 Undertow 2.3.24.Final is NOT AFFECTED by CVE-2020-10687. All required fixes for HTTP request smuggling (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) were included in upstream release 2.2.0.Final (September 2020), well before this version. The target contains all defense mechanisms: (1) HTTP/1.x request target character validation via ALLOWED_TARGET_CHARACTER array, (2) HTTP/2 pseudo-header vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10687" }, "impact_statement": "not_affected \u2014 Undertow 2.3.24.Final is NOT AFFECTED by CVE-2020-10687. All required fixes for HTTP request smuggling (UNDERTOW-1165, UNDERTOW-1774, UNDERTOW-1780) were included in upstream release 2.2.0.Final (September 2020), well before this version. The target contains all defense mechanisms: (1) HTTP/1.x request target character validation via ALLOWED_TARGET_CHARACTER array, (2) HTTP/2 pseudo-header vali..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-10705 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-10705" }, "action_statement": "Vulnerability CVE-2020-10705 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T02:34:48.218490+00:00", "status_notes": "Vulnerability CVE-2020-10719 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2020-10719 addresses an integer overflow vulnerability in HTTP chunked transfer encoding parsing that could lead to request smuggling. The target repository (Undertow 2.3.24.Final-tuxcare.1) is NOT affected because the upstream vendor fix is already present. The fix commit (bfc8fbd67) by Red Hat was shipped in upstream release 2.3.24.Final, which TuxCare subsequently onboarded. The overflow...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-10719" }, "impact_statement": "not_affected \u2014 CVE-2020-10719 addresses an integer overflow vulnerability in HTTP chunked transfer encoding parsing that could lead to request smuggling. The target repository (Undertow 2.3.24.Final-tuxcare.1) is NOT affected because the upstream vendor fix is already present. The fix commit (bfc8fbd67) by Red Hat was shipped in upstream release 2.3.24.Final, which TuxCare subsequently onboarded. The overflow..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1745 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1745" }, "action_statement": "Vulnerability CVE-2020-1745 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-1757 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-1757" }, "action_statement": "Vulnerability CVE-2020-1757 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2020-27782 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2020-27782" }, "action_statement": "Vulnerability CVE-2020-27782 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T03:46:00.265946+00:00", "status_notes": "Vulnerability CVE-2021-20220 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-20220 (HTTP request smuggling via invalid characters in HTTP/2 pseudo-headers) is NOT present in Undertow 2.3.24.Final-tuxcare.1. The upstream fix (UNDERTOW-1780, commit a18574a4d) was already included in version 2.3.24.Final that TuxCare onboarded. The target code validates all HTTP/2 pseudo-headers (:path, :scheme, :authority, :method) against strict character allowlists in Http2Rece...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-20220" }, "impact_statement": "not_affected \u2014 CVE-2021-20220 (HTTP request smuggling via invalid characters in HTTP/2 pseudo-headers) is NOT present in Undertow 2.3.24.Final-tuxcare.1. The upstream fix (UNDERTOW-1780, commit a18574a4d) was already included in version 2.3.24.Final that TuxCare onboarded. The target code validates all HTTP/2 pseudo-headers (:path, :scheme, :authority, :method) against strict character allowlists in Http2Rece..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T23:40:00.392806+00:00", "status_notes": "Vulnerability CVE-2021-3597 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2021-3597 affects Undertow versions prior to 2.0.39.Final and 2.2.9.Final, where HTTP2SourceChannel fails to write the final frame under certain circumstances, causing denial of service. The target version 2.3.24.Final-tuxcare.1 is NOT AFFECTED because the upstream release 2.3.24.Final already contained the fix (commit b92904715 by frainone@redhat.com, merged Feb 2021). The fix ensures that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3597" }, "impact_statement": "not_affected \u2014 CVE-2021-3597 affects Undertow versions prior to 2.0.39.Final and 2.2.9.Final, where HTTP2SourceChannel fails to write the final frame under certain circumstances, causing denial of service. The target version 2.3.24.Final-tuxcare.1 is NOT AFFECTED because the upstream release 2.3.24.Final already contained the fix (commit b92904715 by frainone@redhat.com, merged Feb 2021). The fix ensures that..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T00:12:00.203928+00:00", "status_notes": "Vulnerability CVE-2021-3629 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 The target Undertow 2.3.24.Final is not affected by CVE-2021-3629. The vulnerability (HTTP/2 flow control DoS via indefinite blocking when peer doesn't send WINDOW_UPDATE frames) was fixed in the upstream release before TuxCare onboarded it. Three related fix commits (UNDERTOW-1910, UNDERTOW-2034, UNDERTOW-2056) authored by RedHat engineers between July 2021 and March 2022 are all present in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3629" }, "impact_statement": "not_affected \u2014 The target Undertow 2.3.24.Final is not affected by CVE-2021-3629. The vulnerability (HTTP/2 flow control DoS via indefinite blocking when peer doesn't send WINDOW_UPDATE frames) was fixed in the upstream release before TuxCare onboarded it. Three related fix commits (UNDERTOW-1910, UNDERTOW-2034, UNDERTOW-2056) authored by RedHat engineers between July 2021 and March 2022 are all present in th..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3690 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3690" }, "action_statement": "Vulnerability CVE-2021-3690 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-3859 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2021-3859" }, "action_statement": "Vulnerability CVE-2021-3859 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2022-2053 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-2053" }, "action_statement": "Vulnerability CVE-2022-2053 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2022-4492 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2022-4492" }, "action_statement": "Vulnerability CVE-2022-4492 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1108 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1108" }, "action_statement": "Vulnerability CVE-2023-1108 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-1973 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-1973" }, "action_statement": "Vulnerability CVE-2023-1973 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2023-4639 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2023-4639" }, "action_statement": "Vulnerability CVE-2023-4639 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-11-01T01:49:00.101185+00:00", "status_notes": "Vulnerability CVE-2024-1459 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2024-1459 path traversal vulnerability is NOT present in target version 2.3.24.Final-tuxcare.1. The upstream fix (commit 9b7c5037e by Red Hat developers) was already included in the upstream release 2.3.24.Final when TuxCare onboarded it. The defense code that preserves semicolons in dot-segments to prevent \"/..;\" from being treated as \"/..\" is present and active in HttpRequestParser.java a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1459" }, "impact_statement": "not_affected \u2014 CVE-2024-1459 path traversal vulnerability is NOT present in target version 2.3.24.Final-tuxcare.1. The upstream fix (commit 9b7c5037e by Red Hat developers) was already included in the upstream release 2.3.24.Final when TuxCare onboarded it. The defense code that preserves semicolons in dot-segments to prevent \"/..;\" from being treated as \"/..\" is present and active in HttpRequestParser.java a..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-1635 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-1635" }, "action_statement": "Vulnerability CVE-2024-1635 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T23:33:00.189735+00:00", "status_notes": "Vulnerability CVE-2024-3653 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2024-3653 affects the LearningPushHandler in Undertow when maxAge is left at the default value of -1, allowing unbounded memory consumption. The vulnerability was fixed in upstream commits 6b8e79c16 and a03e5189b, which replaced unbounded HashMaps with size-limited LRUCache instances. These fixes were already present in upstream release 2.3.24.Final when TuxCare onboarded it on 2026-07-13. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3653" }, "impact_statement": "not_affected \u2014 CVE-2024-3653 affects the LearningPushHandler in Undertow when maxAge is left at the default value of -1, allowing unbounded memory consumption. The vulnerability was fixed in upstream commits 6b8e79c16 and a03e5189b, which replaced unbounded HashMaps with size-limited LRUCache instances. These fixes were already present in upstream release 2.3.24.Final when TuxCare onboarded it on 2026-07-13. ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-3884 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-3884" }, "action_statement": "Vulnerability CVE-2024-3884 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-4027 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-4027" }, "action_statement": "Vulnerability CVE-2024-4027 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:54:17.970911+00:00", "status_notes": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-examples 2.3.24.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2024-4109" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-5971 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-5971" }, "action_statement": "Vulnerability CVE-2024-5971 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-6162 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-6162" }, "action_statement": "Vulnerability CVE-2024-6162 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2024-7885 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2024-7885" }, "action_statement": "Vulnerability CVE-2024-7885 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-12543 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-12543" }, "action_statement": "Vulnerability CVE-2025-12543 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-9784 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples.", "vulnerability": { "name": "CVE-2025-9784" }, "action_statement": "Vulnerability CVE-2025-9784 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.undertow/undertow-examples@2.3.24.Final-tuxcare.1" } } ], "timestamp": "2026-09-25T14:47:00.173780+00:00", "status_notes": "Vulnerability CVE-2026-3260 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-examples. already_fixed \u2014 The target repository (Undertow 2.3.24.Final) already contains the fix for CVE-2026-3260. The upstream fix (UNDERTOW-2677) was included in version 2.3.24.Final before it was onboarded to TuxCare. The fix prevents the multipart parser from overriding application-configured entity size limits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3260" }, "impact_statement": "already_fixed \u2014 The target repository (Undertow 2.3.24.Final) already contains the fix for CVE-2026-3260. The upstream fix (UNDERTOW-2677) was included in version 2.3.24.Final before it was onboarded to TuxCare. The fix prevents the multipart parser from overriding application-configured entity size limits." } ] }