{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e69b070e-58e2-5409-a561-1641eb57298a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-parser-generator", "purl": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1", "version": "2.3.24.Final-tuxcare.1", "pedigree": { "ancestors": [ { "name": "undertow-parser-generator", "purl": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final", "type": "library", "group": "io.undertow", "version": "2.3.24.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c3dd5853-67b4-5067-873a-6866120ea0d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:89cbcf2c-d1ec-5211-bec9-78de1e4ce93e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c9528110-ec5d-5540-926c-5bc97317246f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7da7dd52-2826-5eb0-8d8d-deb92f8b374a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12196 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b631169e-683f-588d-b880-1a896301b364", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1016ced9-07a7-5a11-92df-f92f8034e307", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:aedad524-8bf7-5035-8f76-2adadff371f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6a0ed96e-b787-5a4f-8e26-c1aa8db408b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1114 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:86d13abb-96aa-573a-aaf6-7b7448bbd0ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7dbfe0a0-2faf-5bec-8189-c1af990d3f98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b00e933d-b73c-5ca8-b516-8ea1271441e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f1e24e28-4bf6-52e3-b46a-f9f3d2523519", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5a79dede-059e-54b9-b801-d21b4af27812", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:31eb2d98-05dc-50ff-bdc0-abce2135a26d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8fdd1189-4e26-58c6-97b6-00ef3e24aaff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:93262668-e4ff-5811-a81f-1e1d2fd49371", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:456c0e95-b0c7-583e-9ea3-bcbe300c1fb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8ec00535-9085-53da-b56c-b126152d5189", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:679ac199-4051-5554-95be-673c41a6abd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:65f101a6-4d79-536c-9540-2b5c5cba65d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:643ae7c8-2b48-5336-86cd-a66402582172", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:348c955b-893d-5c80-bae2-998e701d489c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6cc496bf-44ef-56f7-8184-a6b877e592ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6d8cf353-5dad-5184-b6f7-898d85c6424f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c419accf-a728-5222-be7c-27e7abb2aedc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8db70d05-c3e4-5fc3-a35b-0f4385f05186", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f7d4f8cf-4ca6-5835-94e9-0d6b3b1d60e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:24b331a7-f3aa-573f-85f2-5f59b48208f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:84e62fa4-e78a-5736-8a07-67de9ab4f52d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b223f738-afac-5427-a48f-b98dc457a7ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-4639 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b6c92624-9427-51de-ac76-bbee72601e6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2a688ba2-8e49-514d-8782-17135090cb5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:710a2796-427c-5cc4-8417-9d48d4a3ab9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:02bbde1f-50fc-58f9-9913-c9676bc8c8ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7c2a79d5-7122-55d2-997b-25ba28c29030", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ce2efa01-274c-5fba-a702-8cb55a5fde25", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-parser-generator 2.3.24.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7ecc72dc-d79d-544a-b02c-d569ff31740b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f9cf4614-1f20-5b72-92b2-a4cf857c5e4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:080b98bd-1420-571d-b955-05304286c00a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:45171274-ce05-5bfe-a9b9-90eace298dad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2359bbd9-8c0d-5242-8968-967ead09eed2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d1e7c7bb-9cca-5b47-8249-55d0a9408819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7f83a5c2-3380-5135-bd24-3493ba40a822", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c0250786-6242-53bb-b542-1daf4346d73f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:be24eb74-93a9-5cae-9a8b-312ead81a3d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3260 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-parser-generator. already_fixed \u2014 The target repository (Undertow 2.3.24.Final) already contains the fix for CVE-2026-3260. The upstream fix (UNDERTOW-2677) was included in version 2.3.24.Final before it was onboarded to TuxCare. The fix prevents the multipart parser from overriding application-configured entity size limits.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-parser-generator@2.3.24.Final-tuxcare.1" } ] }