{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7e8d189d-cd75-53cb-a292-77a39cdf3124", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-servlet", "purl": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2", "version": "1.4.27.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-servlet", "purl": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final", "type": "library", "group": "io.undertow", "version": "1.4.27.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9df933da-1a28-5b51-8c21-e8578ca7b0e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0945adf3-06f8-5663-920d-ae74b927b342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ef0c63cf-6a73-51a7-b221-4f6429b8d9d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6f694488-17b0-5fe8-a395-14719b346c3b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6a60033c-6013-514d-860b-c17d9807594c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7b5fd6a9-6db8-5914-a7e5-08f4d11a184d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:141e5ab0-a238-5b0b-be7c-a523c80610ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:deed7f99-d396-5100-8e34-6e1bafa8d4f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cfa12167-c88e-507d-88bc-0a3f05e10ad3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:57db389f-c369-5243-b5d4-82a6ce5fde73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:afa8ffa4-1878-5541-a22d-83ce17a2f0d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f9ccc3ca-4bc8-5e34-9d8d-781acdc7c890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:32c84ea0-96cf-503e-bf50-50b05a2e8ded", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4cbec0e3-eb5e-5e0b-81a3-28a680a8a354", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2bfd77b0-77e7-5342-b2f0-7fe06b0a8d76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b809e696-2483-5e4e-a832-554c4ec85c8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a764aae2-85d4-5515-8ea4-0b571e4de0e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:93580cf4-8e8d-5a6c-849b-94aabd64c329", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:defd1644-c014-5f79-9ea8-1d92f7cb6475", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6e144dcd-34f4-5ead-909e-280d2cfceeea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d44c00e4-be61-5d8c-bcf9-2444fb85e73f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7396eea5-2362-5bac-9c3e-bc2cf8a6343c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:eff3a256-7d8f-5e14-9256-d24efeb1862f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0bc4b823-e541-5b5e-a3d9-081450b01b96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7143fd82-a532-5c02-a5ad-29e8146660f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:68f5a6d5-8a5b-5803-a9b8-d844cdb9d296", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f4ff735d-8655-5f44-893f-80c656492c09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2ad41ccb-eb59-58f2-b0b7-871bee0cb015", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bb49d685-cf40-5287-8acf-eb8901c468f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d53ad986-f48c-58d6-a47b-56615671507d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:85d29f83-eb49-5e8b-8d6b-6f0909a709fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:71f6cd12-1c9e-5855-84ab-03067f840c17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:34f540fd-6883-51ef-9706-d02ddf327583", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:049faaf2-17df-5f1a-b8c3-8b701d94d415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:fab790ae-44b7-56dc-aa88-95d63914c9a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c6ed45ca-984a-54a3-9fe5-3499f300fff9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ab480a8b-d81f-519d-b20b-21a5b4874de6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b579b8ef-7052-521e-90dd-cb8fc60f2a38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8d351469-90e1-5a1e-b5b5-78c88cc13ee8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-servlet 1.4.27.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7218fcf9-178e-5b0b-b468-59b0abdf51c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4abfdeeb-f827-569c-9e89-5aaaa13b9bee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:01129556-872b-5b66-9699-c9fb3d431da9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:23c0692d-07fd-5a64-a371-762b1d2d9285", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:02f4bc4f-bfeb-5041-a927-13b851bb974a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a97a14c3-1806-57a6-9ccb-3fa929193dfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:635bf22a-86cf-5aaf-a354-08a94bae7841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d3b9d277-c1bd-57ad-afdf-ec0c48a4cf9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0f9ab74a-e827-5d37-971f-92d14f12ef2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-servlet." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.2" } ] }