{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:547abe5f-6216-52f8-8e11-8bddcdc362a1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-benchmarks", "purl": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1", "version": "2.3.24.Final-tuxcare.1", "pedigree": { "ancestors": [ { "name": "undertow-benchmarks", "purl": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final", "type": "library", "group": "io.undertow", "version": "2.3.24.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bea75d16-415a-50f9-994b-23a64a13905f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4f3e77fe-b68c-5188-b0e9-70367a79f6d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:66b1f052-9014-5748-b594-a734c01288d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6a034518-7f8d-56b1-ba24-f14202261968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12196 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:68f6f0d5-bbb2-57e6-bd95-fd1974cc1525", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:af00f9e1-6569-507c-9ac8-9d5eb64a2bd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:56eb4815-dca3-5c4f-8a96-3c72d59afa58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:77f1011d-6151-597d-b31d-941b4545b507", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1114 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d6c54381-5eed-5f85-9b71-2ec7b35ed75b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ba7bacd1-ac62-5663-98aa-cf0386dab9df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6ec30be2-db63-513b-8ad2-37d270c98197", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d3138d0a-2648-53b0-a12a-7ab3714b460b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:56f478a9-622a-56e1-a436-b326e2942aa0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a55c5094-24a0-5ab5-818f-66dd99f78000", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:04f8ac73-d822-55d9-95f6-9bc933bac2a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:be600eb0-8466-5141-99a0-9d5fa3bec772", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:43e49364-f071-5dac-b029-a81f92be29be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5efec60c-fc9d-5957-8d4f-2e27b5b77f47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7e1067a3-37f1-5b73-bb6e-d3149e0b1e7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:dceb6e6e-3350-5600-87b5-516c27c08090", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:32e05745-13ed-5152-baff-ed4f71432530", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c06f8f22-3817-5be3-85ba-d25a2a403ab3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f0cfc1c2-a055-5cac-bb24-a178eed85cb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ee3b3f97-7d2d-565e-accd-da7dada127b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3af1f18e-55ca-597e-8f6c-51917e837096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ead96c73-05db-5ee8-b313-ac2802d6b5e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:53fdd039-4a6b-5642-92b2-13632f1b2e4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e591a359-645c-502f-9b7e-4bbdadd444c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b86342ee-add4-5b11-8801-418fb1990baf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:dbe69cbf-c20c-575b-a904-048265bc388a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-4639 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:99534c04-c067-5d88-89bd-683a903bbbd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bd34cf25-0e2f-590a-9629-8bed37ad97a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:27673c1c-b115-5fa4-b36a-b403b109ddab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0b553eab-cbb8-5fee-8fce-14baa6c550ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d930a237-97b6-51ff-b139-2e921ab24a92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:78faba47-6953-5be4-b02a-50447209bde7", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-benchmarks 2.3.24.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:77f7ee6b-f307-548a-be15-7764c857b4c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c8d80318-f716-5376-a9ea-4a22537c140d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d7a46308-7ef1-5a4d-ac91-fd35ca446ff3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5b29f90d-ffb2-5947-9d7a-34b7150a7f37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:10e9c528-a37d-501c-9ef3-20ff77862755", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0f14bffa-28b0-5346-9b8e-f335d095fd65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:20ab0d4b-a25a-5a0d-8260-1672f6f13107", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9e10d1b9-71d8-5dd8-9dbf-2d4e9b0c76b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8f350f0a-a172-5129-9814-46d432960ea6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3260 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-benchmarks. already_fixed \u2014 The target repository (Undertow 2.3.24.Final) already contains the fix for CVE-2026-3260. The upstream fix (UNDERTOW-2677) was included in version 2.3.24.Final before it was onboarded to TuxCare. The fix prevents the multipart parser from overriding application-configured entity size limits.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-benchmarks@2.3.24.Final-tuxcare.1" } ] }