{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:586a1f73-e769-58be-8d2e-ac41f3d5aa58", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2", "version": "1.4.27.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@1.4.27.Final", "type": "library", "group": "io.undertow", "version": "1.4.27.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b6eb930f-e400-5344-86ae-98f40559044d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7e2fc5bf-ef35-56b5-af03-d7461d4305fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:234f7a25-37bd-5417-b124-200766cc37c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3d4b64ff-acfd-5893-912a-788d254659d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d55d6c5b-6249-54ef-b3c5-789d84de2c54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e48db404-ba45-56dd-9c68-444ed331ff95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b563d8dc-1de5-5403-932a-8cb6144331b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a0e44e99-b544-520e-bd77-1f05368651ac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ba24b2c1-104e-5a3c-9b89-8c930992f3af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0ae62c28-ca5d-5034-bb91-8202f697cd53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:25207377-3b2a-56b1-a772-7cd27f617a04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a4c49cbc-62a8-59f6-a402-7b9011032e7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d5cc89d4-b1f9-52db-8a0b-d06abccb8443", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7ed92c7b-a100-5479-87fa-fc7d1effd81a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6f62f0be-8938-5f47-bf17-96cd076d7db9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:81ead7ba-c518-55b0-b66e-dba90b727360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e76930a3-4254-529d-9cd8-0705e0ff7338", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9f23a9d1-960e-520f-b317-6ea7d861abf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c5474e90-8583-5818-9b79-c168c1a21fc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4029309f-0afc-5354-8ea5-091cc8a8b8ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5e88047c-d9a0-5114-b9b3-8f3ac1fc2e3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f3e3e61b-8714-5746-b954-a282ffa0c951", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8e70fbdf-5fc0-5a41-8dcd-400f79f8fa8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:97478000-f0ef-541a-beac-ef202d39c01f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c25ce906-9af4-52e7-96ae-10d676735113", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e4dc8bfa-f402-5e3e-a026-bd36f37d8262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e499841f-5eab-5518-a75e-baa4ea58446b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:554c3c64-3d58-5e4f-a4e6-87f5523c53c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:81315c32-8aee-56e8-93c6-e279e1bf457d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6b1585ec-c04a-568e-a551-7088ecc62a67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:29f0e2a9-8a90-5bdb-9e96-01e27b0f31b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:42fbb650-6c29-581b-a63d-181ac7911c38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:dc3947e3-457a-53e7-b146-cf60cdcbfe3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:72a3119c-9d47-506f-9324-a5b774d4cd4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7fe84a5e-8173-52f1-81bd-38c42c812861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:65f2b085-f9fb-5c15-a98a-de930263d573", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4aacc051-9dcc-541e-922d-1c80185f3e29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bc82a1da-0802-53b8-a14c-a662d2d89f8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3e5b4312-b8d3-5b39-93fb-749d57d63121", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 1.4.27.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3afa12da-d565-5f81-b817-e8f65d71ddaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f9b4343c-0c1c-53d8-9e34-272225f2f30e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bfc51b85-24a3-5187-b6f9-8e44790a0dc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:80a178b9-5906-5fae-8bcc-b2535d2f116a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:aab8d2e3-e95d-54b3-9f8c-2214f581b594", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e549862a-8407-5f74-b4c6-1da00da3c8f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d62f1ee0-f95f-5db2-b2bc-169c21b84a74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cc0fd266-f76e-59be-a030-a66ef1cf796e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9df227d5-69e2-5f69-abb0-1acfc53170b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.2" } ] }