{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6acd9281-3f69-5349-a80d-9ca3f0e516dd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-parent", "purl": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2", "version": "1.4.27.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-parent", "purl": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final", "type": "library", "group": "io.undertow", "version": "1.4.27.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ed8c602c-cc20-59b8-bb1a-5663be7b9f3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:988890e7-d276-5d1a-ab98-4f0c98f18d8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b091e94b-e36e-57d6-919b-1d9c5b1beab3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:67fabf09-65ea-5a5e-a3f9-461623ac32b3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b303af8e-84e8-5191-84c9-87460735e34e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6d184881-10e4-5f6b-925c-75023e913647", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:232932f0-4ee9-530c-9a22-9eff26917938", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6a35a896-834d-505a-82d9-db522ed91f8e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:39b02797-5194-5483-a23b-e180f25c377e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8f751d72-533c-5178-810a-c8a58eafe2b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b064e2c5-aacf-5672-9bb9-6c261f11f55d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:73e2bd70-ca87-5077-93e3-55cdc8d86515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4f3e4919-fb2e-5a91-bf13-bebd90ce7d37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d2b76a98-c353-5a9e-884c-d448dca2316e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:105f596e-9f8c-5bed-a318-eae96ef82f09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3e4a8016-7166-5f04-916b-08376da2b621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ca806c3d-fe47-573e-b52e-20502d97a911", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bf00320f-3805-5e21-ad69-32a40d817770", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8d58d64f-be18-5717-9d0c-ac1abad8ba7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:aea307e8-c75c-5e0b-a3d0-21e737804b79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0de07a5d-cb77-53ef-a59e-12a8c3ad2038", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c24d2d75-061a-5648-a1bf-e1b0fedeb811", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0387d4c7-d1f1-5145-8cdb-d78b63fead5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c9469859-55de-550d-89c9-2101565cc063", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:12892288-ace4-5d29-9e26-9085bad0fee7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d05700a8-363e-5517-9334-704f68fc374f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ed8f1f88-243f-5125-9d5e-85880431e752", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:88afaae1-db35-5395-abbb-a4e8db095aad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:336583eb-4d1f-5452-a662-dfec57b4fc46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:980e266c-a7fa-5197-a6c4-a155256ba3b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3a5cf167-daf6-56fa-9e64-dc22e4128a51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:45c24dff-73ef-5e0e-bcf0-c95b7f2744fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1a6470d4-2d11-576b-8b90-359f4707a030", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9ac16501-e64a-5726-a28f-64c3af4b5a82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a66efa62-8e4d-56be-9d18-e43fd7e02209", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b7959e74-f33f-51ac-83a1-df3017b222fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b6536922-c99c-52e8-bbb2-6b469d8f40a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c8caaddd-1bab-5321-b1ba-588924464b91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c8a63783-ab1c-5d5f-9e3c-32b7b4ca0c41", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-parent 1.4.27.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4301fde2-4698-5c5a-834d-d1bb15fab0a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:223db41e-927d-550e-9195-3074ee6acbff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:50678b03-958d-526c-9fa9-30e2e66b4ec7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3fd12f7e-91fe-5a63-81c1-56e7485199b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5d605b15-3d27-5a8c-a448-94ee65521c9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0c74acf1-1ef9-59ec-9f27-ab07798c25f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1ed37720-94fc-52cf-9ec0-be4b103855cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c187c7bb-5409-5c47-acfa-1572e06242f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d2ba6974-8308-566a-9e52-dee7af773a1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-parent." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.2" } ] }