{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:87abe785-207f-5aac-a53d-ed31a96520c4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1",
      "version": "2.3.24.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.24.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-7816",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0162ae39-c817-5687-9da9-b9b418a9bf4e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-7816 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2016-7046",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:384599cb-17ed-548c-bcdb-0538ce5b29a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-7046 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2017-12165",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:410b9f4f-aea7-5c4d-9868-f5e7f417f6df",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-12165 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2017-12196",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dcf60b6f-d9d0-56ef-9b31-075eb9b9b023",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-12196 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2017-2666",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ec2479b5-27a7-5a1f-ac66-4b9868eae439",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-2666 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2017-2670",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9a0f0ac1-936e-5406-a722-984952bc134b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-2670 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2017-7559",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0fd32ddc-a1fe-5742-a857-d4fc90f85a7a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7559 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2018-1114",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:61793c23-59a5-55b1-98e7-eafccc6c3311",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1114 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2018-14642",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d5d86aa8-311b-5ccf-9458-2b8311aef1ea",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-14642 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:696e400c-683d-509d-be04-d9a519a5c099",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10184 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2019-10212",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:92c7048d-767b-55bf-b651-ae8cc794c39f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10212 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2019-14888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aef6b159-99c9-5844-b73f-7135063cc0a8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-14888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2019-3888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:100a2348-3abe-5077-81d6-6d0efdf1621f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-3888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2020-10687",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:220a19b9-9d6f-59a7-8402-0f61faad7ff5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10687 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2020-10705",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0a2b3db2-635c-58a0-a6bc-f223d8a18677",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10705 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2020-10719",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1d39c21a-8e1b-5897-9a13-89b7c74328fe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10719 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2020-1745",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e1522355-30fe-5acb-8eca-52f7022bc34e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1745 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2020-1757",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bd1ead33-0905-5c2a-9718-106f7deb25e7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1757 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2020-27782",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:31c13f7f-b12b-5a3c-bf68-1fd41a32fcdf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-27782 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2021-20220",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e3fb5f19-0354-5daa-9e71-1269124c21e4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-20220 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2021-3597",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:182ea3bc-867e-5d9c-baac-fc3eb41f92dd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3597 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2021-3629",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d085b04e-1dea-5ede-8bc9-f9e757b95c3c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3629 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2021-3690",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:00befcec-8191-5ae3-a91f-623a6e907619",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3690 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2021-3859",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:15772565-e605-5af0-9bc9-3b4e1017e665",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3859 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2022-2053",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f212ed6c-28c8-5116-b682-15b549494683",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2053 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2022-4492",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2c779f7d-e40c-5ab2-b6e3-a3e9195f23bb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-4492 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2023-1108",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3232b41e-76e6-5123-bd5d-f23e086772f3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-1108 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2023-1973",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4fdb6221-123f-564f-a601-72097c9c491f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-1973 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2023-4639",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ed664dc5-c95b-5f4e-8803-def08ca66a87",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-4639 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2024-1459",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2d202c52-9fd3-5b26-9c06-4b102802101b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-1459 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2024-1635",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:668cc8d7-3909-5c73-9251-0bd1eb9f9063",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-1635 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2024-3653",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:609cb63f-f47c-5911-b837-1385522068d0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-3653 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2024-3884",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:39129b6a-8864-505f-8178-72e77af8ab6c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-3884 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2024-4027",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:46137b1a-d5b6-5825-bab3-77848f722067",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-4027 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2024-4109",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c38bd938-c727-5209-8892-abec0733c778",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-servlet 2.3.24.Final-tuxcare.1."
      }
    },
    {
      "id": "CVE-2024-5971",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b0081cdd-9941-5368-a15a-47fb8446b725",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-5971 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2024-6162",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c19e9ba5-5e0c-5311-b602-9b0c844b20f0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-6162 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2024-7885",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a7427df5-1054-54fb-9fcd-244a6eee828e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-7885 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2025-12543",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:88a75399-dccc-54c5-b6ed-93f4f0e46e91",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-12543 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2025-9784",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d5b38346-12a3-57f1-b50c-3d33079887da",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-9784 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2026-3260",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4ba52e99-f33f-53d1-a189-a464a7bdc1c5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-3260 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet. already_fixed \u2014 The target repository (Undertow 2.3.24.Final) already contains the fix for CVE-2026-3260. The upstream fix (UNDERTOW-2677) was included in version 2.3.24.Final before it was onboarded to TuxCare. The fix prevents the multipart parser from overriding application-configured entity size limits.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
    }
  ]
}