{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ca3ca3f3-c6c3-5111-826a-90dcec01a7ef",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-dist",
      "purl": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1",
      "version": "2.3.24.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-dist",
            "purl": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.24.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-7816",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ddb18d83-53a9-5646-baa6-1e1245021f30",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-7816 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2016-7046",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0e88bd1c-50fb-55a5-84e9-e531fa75b3f7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-7046 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2017-12165",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3e6a53e6-cc25-5267-ae08-3a964e55d1c0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-12165 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2017-12196",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bf5c63c6-de33-586e-b573-13ed0d0997e7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-12196 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2017-2666",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:88ae5649-6a2f-5ed3-993c-b7ffb923cded",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-2666 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2017-2670",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5153ea26-0f8c-5d14-af23-7f8dadd69a1b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-2670 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2017-7559",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a3742755-7178-5a95-a683-4fc4ebd540fc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7559 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2018-1114",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1703817b-2b14-54dd-b72a-ee504e852cfe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1114 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2018-14642",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e94b8d23-6cad-5dba-8a07-1602199efeb2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-14642 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0a31c13b-b785-5e5a-93f8-fe306ce0acb7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10184 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2019-10212",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3ba3b000-5ae1-556b-9e5d-91e130388d2d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10212 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2019-14888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:01567377-47db-5570-9f2f-a3548061ec50",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-14888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2019-3888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9dd03fff-6c22-51a8-9011-da704d07f609",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-3888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2020-10687",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2dca5563-e878-5ac7-9327-8c1cccecca3c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10687 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2020-10705",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:50f92a10-fa8c-50d4-b787-8f86a0ab48ab",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10705 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2020-10719",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1eeb0c9c-fb83-57b0-af5e-8645200cfac4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10719 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2020-1745",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:df34b618-f3f8-512b-b133-e3d317d2abfb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1745 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2020-1757",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e013e815-de39-50fa-91de-96e48de6df80",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1757 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2020-27782",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:18720daa-e56e-5de5-af0e-b791d5bc3e53",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27782 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2021-20220",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:655aa21e-b46d-5db0-88ed-3c70d411069a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-20220 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2021-3597",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:794d4ef2-607b-594a-99ec-30408ef13590",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3597 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2021-3629",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:230d97e5-119e-5761-bcb1-f73bd671329a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3629 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2021-3690",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8641f94a-feff-5ca9-9032-52210ac8e3c8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3690 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2021-3859",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d787b6bf-16c8-5c7f-9e3f-62c33fb57316",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3859 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2022-2053",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8e84b85f-9a0c-5dc7-8b44-b757472fcc63",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2053 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2022-4492",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:954c7315-5385-5b88-ad83-40c8c2eb13b3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-4492 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2023-1108",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d2a5c99c-833f-5705-af08-46b6f3f53bf4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-1108 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2023-1973",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:536984a5-3237-551f-8b5b-e9e3a767c1ca",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-1973 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2023-4639",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d60e20b4-9bab-5a8c-b9a3-177c87cd954a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-4639 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2024-1459",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c9b797c5-18fc-5b34-b5bd-0a63ea39ea43",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-1459 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2024-1635",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:614941d0-e9f0-5e3c-a175-98667a35c136",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-1635 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2024-3653",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:19ff5ed1-0fb4-589d-b9df-3be36ff21fe9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-3653 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2024-3884",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:274430e3-64c5-54de-8dce-ceb7529763e5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-3884 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2024-4027",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c132d592-1946-51da-9669-be313bcadb27",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-4027 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2024-4109",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f6f01c45-af9d-55fd-a6cf-1d17a78323d3",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-dist 2.3.24.Final-tuxcare.1."
      }
    },
    {
      "id": "CVE-2024-5971",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6336d0d3-742d-55fe-86d5-e17c2bde8e37",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-5971 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2024-6162",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e78d7f96-a947-5816-b3f5-6a859ccde8a0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6162 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2024-7885",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:642a8884-5fa2-53a7-a8d2-4a038ea8a558",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-7885 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2025-12543",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:40624517-0b6c-5b9c-8a86-1abcae1c72dc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-12543 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2025-9784",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7bb462c1-0314-52e2-8bf5-685a252cc5a0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-9784 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist."
      }
    },
    {
      "id": "CVE-2026-3260",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:693a0da7-708a-5a8c-9d08-57d779efc3b0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-3260 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-dist. already_fixed \u2014 The target repository (Undertow 2.3.24.Final) already contains the fix for CVE-2026-3260. The upstream fix (UNDERTOW-2677) was included in version 2.3.24.Final before it was onboarded to TuxCare. The fix prevents the multipart parser from overriding application-configured entity size limits.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-dist@2.3.24.Final-tuxcare.1"
    }
  ]
}