{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fbfb1b7a-a3fc-549b-91fe-75f564bbe07a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-core",
      "purl": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1",
      "version": "2.3.24.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-core",
            "purl": "pkg:maven/io.undertow/undertow-core@2.3.24.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.24.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-7816",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:040577d4-9fa5-526c-b9c0-d948ff0c93bf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-7816 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2016-7046",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:76d7c73e-2300-5678-8a1a-f28294eab8d5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-7046 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2017-12165",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5a0758d3-9826-5abc-9d6a-9a85afc46191",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-12165 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2017-12196",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e000726e-c3b8-52cf-9105-0ddcdebd5f8e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-12196 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2017-2666",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:203783af-779f-5131-9cde-6309d559ec13",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-2666 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2017-2670",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b3a4e075-92b8-5f7f-b0f3-a3eccade5a00",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-2670 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2017-7559",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bdc0db8c-7d62-5326-a83d-abdb8daabd70",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7559 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2018-1114",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:53a55cb8-0b0e-54a7-a33a-425ec9217dfb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1114 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2018-14642",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:28f7dc95-2b6f-5453-8224-d0128384270d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-14642 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0136908f-f172-5c70-a859-70b0fadadf46",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10184 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2019-10212",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6c083ca1-fc47-5bd7-8047-97a862a7faa8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10212 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2019-14888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:41d83b9a-291c-56f3-8f18-86a7efbf4a1e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-14888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2019-3888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c949d5ff-3c8d-57b9-a422-1ffb88b369df",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-3888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-10687",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7e4f40f2-797f-58ab-9a7c-9f9f48d90037",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10687 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-10705",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:83115235-8d31-5f5f-abff-20638501a209",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10705 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-10719",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:35873567-9bb8-5ae1-8387-bab1102b2f60",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10719 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-1745",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5a079d04-04c8-5f7b-9745-e5227622e74b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1745 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-1757",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0f77c5d8-946e-59f2-b85b-2e2276eddb1b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1757 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-27782",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:33a76a7d-f509-5b79-8db1-97d923f12880",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27782 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2021-20220",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c92ca2f6-3755-58bd-9cd7-b7885e0e1dcd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-20220 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2021-3597",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:78bee090-571a-503e-88b3-b643ecb9a559",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3597 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2021-3629",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:575182b8-f502-588b-be1b-94b1251c16d6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3629 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2021-3690",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3d728f12-75c8-5596-b7bf-a3c35a4cc606",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3690 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2021-3859",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:00363554-15b8-5dd4-832e-c91beaab71f5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3859 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2022-2053",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bf51cef1-4b36-51a2-aca2-aef9b2912939",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2053 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2022-4492",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cc48ad65-3d31-5982-9ee6-546c63f4849b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-4492 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-1108",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9c034aa4-29ae-57cd-941b-5db39549bf8f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-1108 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-1973",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9f6c60ac-50c8-5519-9874-7add3533ec72",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-1973 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-3223",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3cbd31f9-8e7a-51ec-b4c6-6dcdce46270f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-3223 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-4639",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:626c070c-82f3-59e3-83d9-4bdea25e2395",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-4639 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-1459",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bdbf2004-fedb-5db6-8da4-bcd3c36155ae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-1459 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-1635",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:28c27e2e-e912-5360-b62b-63de07c3c3c9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-1635 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-3653",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0a41cbaf-e658-5180-b709-3a230f594863",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-3653 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-3884",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6ff08200-a169-5a92-ab3b-02bdb707e6a3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-3884 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4027",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e988c546-0b37-50bc-810f-d532f6bf6fa5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-4027 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4109",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8917c72c-ed68-5a27-8847-aaebf5c66d6f",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.3.24.Final-tuxcare.1."
      }
    },
    {
      "id": "CVE-2024-5971",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3f803143-cec2-59c9-861c-adf59a9618b7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-5971 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-6162",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:527a5553-8b62-52f4-94ec-ffeda79392c6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6162 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-7885",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9a329492-2569-5bd0-bb0e-aaa9b9f8b2f5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-7885 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-12543",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f33f10ed-6686-5521-9a00-da640d19dd83",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-12543 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-9784",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7e60093b-53d6-5dcf-85d6-4ebe2e7aa8fa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-9784 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28367",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ad367db1-a6b2-5665-88bf-f73c1cb5503a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28367 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28368",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:edc6c1b7-4360-5cd3-a064-2683ce5943c4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28368 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28369",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4fc6719a-a833-5aa7-abb7-7898d44c2661",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28369 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-3260",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dc128ad6-162e-5401-8590-45c478d5dbff",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-3260 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-core. already_fixed \u2014 The target repository (Undertow 2.3.24.Final) already contains the fix for CVE-2026-3260. The upstream fix (UNDERTOW-2677) was included in version 2.3.24.Final before it was onboarded to TuxCare. The fix prevents the multipart parser from overriding application-configured entity size limits.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-core@2.3.24.Final-tuxcare.1"
    }
  ]
}