{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:37ec8323-29e4-54a0-bb79-25240ed61976", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-servlet", "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2", "version": "2.3.17.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-servlet", "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final", "type": "library", "group": "io.undertow", "version": "2.3.17.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:fff766ba-a78e-5d90-8807-dc6e68c78bcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d14b341c-9969-53a7-a891-c98284ea6b50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2bc9a5ef-dee5-5fe7-93a7-a34bdddf0d15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:866b0315-940b-544d-9bc3-6151a96529fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12196 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:93248961-9fdc-50a2-adc9-45bbe421ee22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:28505f30-0fda-50ad-807b-5834cf51dcf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e7358875-8cc0-5c02-b39e-60d70e76094d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a61c91cb-a5f1-528e-a28b-d5839c134c4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1114 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1724d52a-87c1-5f8b-93a7-c3abddd925dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9b3cecab-3380-552c-8ae5-4e40bf97acc1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e15bdb2e-7539-5167-8667-2d4e3f717e70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f3bd2382-10ff-5a8d-a3f5-ddbfe09b9df5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5ca2be31-aef7-5710-b9b4-693f8d3bf48c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6bcc8799-61ba-5410-968b-48c642e5a1e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9e0a4195-66e5-531b-8b79-d138d72195c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b2ee695e-f325-5f7c-9f4b-00122a6436f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ff3cb31a-3bf6-544a-ba1e-87552c7c477b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d2935936-b56b-5c7a-8fcf-941478efd760", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:128809f3-01f0-5ff1-b8a2-ee56bee96462", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5493d78f-af48-524c-ad7e-bc985965227a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:dfb7e8d8-6ccb-5aec-bbb2-d690580a1520", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bc1a466f-bc65-5c5e-b577-d9befadb98b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:06a73fb9-3a60-5a07-a656-be095fabdee2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:214d03f4-05d0-5d7c-9ec2-e014bf349cdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:18dc9fd0-cdb9-55b1-91c3-cc54adc0fdc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8a678bca-e5fe-5378-83e3-883e75e2dd86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b271b2e3-6999-5ad5-ac0d-49f91580657c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:73f940b7-5071-5835-9920-02d90865b323", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:31a7a6de-bb02-512b-ae19-0b5c14e0ff3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5d219bef-98a0-5f94-bece-0b1bde62e115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-4639 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e88622c1-2c59-54c6-895a-4346a487ac70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f7e0c87b-1997-5b5d-b258-14fca5e8f242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c7efb3ef-3c01-5f0f-8f95-4bfb504be990", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:76685659-643e-5243-a7eb-ca121ae67d19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-3884 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:97adfd76-8368-5314-9356-7658a6899d8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:79e5e57f-3631-5944-8131-3b8ec1ae087e", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-servlet 2.3.17.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a6ee5226-9368-59da-ad26-0d1250cc7cf0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:15fb38c3-8a66-5003-83f3-159361678aeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c5d845ec-45b8-50f9-8bf2-667cf3c4cdab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:eb9f2e00-493c-5f5e-91a5-58f95823efa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a787db78-19d3-5ba5-8fae-4635b33c7d76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-9784 is fixed in version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ecd03615-b3c7-53cd-90b8-8a2e8605ee46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6ad304bb-82ae-5a1a-a2d7-ab662f7ca478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e8bc1bb0-5bfd-5dfc-a722-827857755743", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-28369 does not affect version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet. already_fixed \u2014 The target repository (Undertow 2.3.17.Final) already contains UNDERTOW-1774, a fix from February 2020 that causes the HTTP parser to reject requests where header field-names start with whitespace characters. This fix addresses the core vulnerability described in CVE-2026-28369 by throwing BadRequestException when such malformed headers are encountered, preventing request smuggling attacks.", "justification": "code_not_present" } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8264b5b0-d49b-5dec-a9b8-0ae44c29fa63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 2.3.17.Final-tuxcare.2 of io.undertow:undertow-servlet." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.17.Final-tuxcare.2" } ] }