{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:04f23038-ddff-54dc-8961-be1e2505777b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-parser-generator", "purl": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2", "version": "2.3.17.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-parser-generator", "purl": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final", "type": "library", "group": "io.undertow", "version": "2.3.17.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:581b9fa1-8770-5f2a-9875-9bb07f555b11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6d398111-cd31-5aab-a49a-42a638d06808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f0789891-075b-51a0-9520-d6d7a4155a7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:435e990e-345f-564f-baaa-b59547315fed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12196 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c684c5c5-d10c-5f26-a8be-7cc4719031c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3e2cf3a5-3b0f-5d25-85e4-efa40a3cf820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:db3c3f57-0312-5e47-ba67-1699d56ee815", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:afd200d2-9758-5985-9242-d487c3f1a520", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1114 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f57a6c84-b141-5b86-9cbb-1514065fcc9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3699ca8b-1c5f-514c-bb3c-8a6a77f7e1f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:029352fa-b074-5993-90d3-cbaa1f57ecd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f5ba53e1-ce6e-5aa9-8139-c3253e075a94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6c33413d-2ab3-564b-a1b0-ca8afd4159e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:604acc15-0854-5e9f-9474-52b40f075e0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d5af7564-2614-5cc3-b1e2-e88a2d73120f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:270e06a3-c642-55ae-a0d3-bb9883b7e986", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:95dcd6ca-7904-58ce-9af6-2b3f9d86263b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f43fc9b1-1d18-5d86-aef6-08a0a921b209", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f2d59925-b362-5517-a962-a0bbf3ea3132", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2507ab7c-d89c-5e00-99b5-254af96ac248", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:60c4cb17-35ba-5e95-a864-f63c0c98c1f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3dd052ca-5b56-5b7f-90c4-e617e1433f95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:040ce975-22c9-5f32-b86c-d4fb411fbb7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6d9325f1-2716-5375-8148-3b43cd92a2a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:79204596-89b7-5db1-8e29-f406f22e2b9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1fc67bfb-cd27-53a0-8c23-e32d2a8ea935", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:525b46ca-4eea-5719-8df5-4d0eb49d27dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:27bfa3a7-eeb7-59a8-aa5f-48d2c1a4e6da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b8f87d0a-2764-5989-bffe-bd81b7bd14e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cf72b525-370c-5a6c-9a1b-88b380b32576", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-4639 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:367c09ae-7297-5f37-8744-fb97cf2177ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b8f58455-13b4-588d-994e-74d56f7b57ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6914a5d7-bf55-5404-ba14-2b5c00c24fc1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:16ee7e61-0e7b-50f9-a4de-1cbd66d1ce06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3884 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:da040a48-35a6-542b-a033-36c085ab5d5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:173bc2da-1fbb-510d-bef0-8bf231e206a8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-parser-generator 2.3.17.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d7e7dda2-0215-5cec-9477-588ff6120131", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9bced409-386e-5e59-a40c-01d8bf6b3fe6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:defb131d-35d1-5966-8097-dc62f21ae85d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:08171676-5596-5879-9e40-aaa47fdc6fe6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:59d73b49-bac6-5595-bf93-8a3153b709f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3c770438-5f8e-57b9-bc10-33dfa785cf2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a6788697-b61d-533a-ae77-43d129d6587d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0a9a7c19-7186-5930-b176-a1f9a0d92f4c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-28369 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator. already_fixed \u2014 The target repository (Undertow 2.3.17.Final) already contains UNDERTOW-1774, a fix from February 2020 that causes the HTTP parser to reject requests where header field-names start with whitespace characters. This fix addresses the core vulnerability described in CVE-2026-28369 by throwing BadRequestException when such malformed headers are encountered, preventing request smuggling attacks.", "justification": "code_not_present" } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cc4e63ab-08f2-54d9-9a90-2824920afb4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-parser-generator." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.17.Final-tuxcare.2" } ] }