{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bd6a3628-d53d-5113-a112-34a3f93400ab", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-websockets-jsr", "purl": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2", "version": "1.4.27.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-websockets-jsr", "purl": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final", "type": "library", "group": "io.undertow", "version": "1.4.27.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:30d6fa7a-f1f2-5a0e-a5f2-1cd4b5ff66f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f9eda2c7-9152-557f-936a-0172442df8a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:fc3f0c49-c6d4-551c-8735-5e68fb627ba1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d0fc2e2a-98db-5e30-931d-a35659a508ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d4730436-2850-5385-9fd1-6452a5e9cdca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3bbf40f6-70d9-5ae8-8d63-0b76cbaa8ffb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1e9491b6-d78a-5725-8c2c-074d8e275549", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:96d996ac-6aff-52a1-89f8-70549ce2570c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e23b198e-a58d-5646-8e09-fd1006b11dd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:350f43cf-2c6a-5bae-93f5-4567c860638f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:264811bc-a5c7-5c81-8993-1e832fb7fa80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9c5a09ae-4e1f-5412-be87-0b5731da0cd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:af3a5f9a-095b-5b5f-991b-6401c71ec61a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bf214c33-4688-554a-95cc-fb08ff4dd9eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6a4d1d1d-81c7-58da-aa2f-88777779ab5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e1d6dedd-1fd7-5640-974a-6f617b072df3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5c516ac7-191d-5779-8e92-79eeecd9eeb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0356e355-4be1-5340-9bcc-31a0162510fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:de962552-12f5-5083-a6f2-7ebff4fc1acb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:82e2ab33-f07c-543a-8fa8-666660352831", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f38fc8c6-c3d3-5c65-a22f-3ce590eacf3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:beadc9e2-e29b-5759-aae5-ec3f247e8efe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3d42cec4-b097-5a1d-ac50-5d5896b67dbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2f2df52f-5ecc-5936-ab39-9b154065e31c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f3d2e402-b9bf-50d4-9264-b9c6ff8c8214", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:29a076a8-ec74-585f-9efe-bac914535db2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:035dd57a-4bbc-5115-bf5f-7feb45e3dd20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e97ad47a-f5bb-5778-bba2-1f123c0fb674", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:208d3b00-7a41-510e-8cd9-5088e3ebe888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bbc6bc0a-9a24-5cdc-94d7-46f4bd6343ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8fe36095-45be-5c1d-aa24-73a6a27ac951", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:226f48d4-0408-5c2c-b313-b8c08a0ad57a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f1f4b39d-c353-5f7a-8262-dafb772dc958", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b4b0951b-07f6-59f8-8a19-3fdbe5ea0a46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:65b6ad7e-bf29-5231-990e-8c6705f1a210", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5366e4a2-2567-58af-bece-db636fd3169f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d9b0b30b-bd33-5f9c-8cf6-f56e2ad1cfbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7da34501-f08a-5ec8-9edf-ae2de6ce0a27", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-websockets-jsr 1.4.27.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c67c53a4-9a4c-5c6c-b37d-9facb83bb8e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b606fd55-ffb2-548d-a8ea-d8d44a166aee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4325ee3a-24ba-5e93-91a6-bc825ab5218f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7191f3b3-0419-5cde-84ba-b6a395f99a1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f7aa2380-86b6-53c8-a077-575b3c64e4dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:878c3acc-8138-598c-bb22-4df15c4dc3ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-websockets-jsr." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.2" } ] }