{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d53b0c12-90e3-568b-aacb-cbe76eaa992f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-websockets-jsr", "purl": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1", "version": "2.3.24.Final-tuxcare.1", "pedigree": { "ancestors": [ { "name": "undertow-websockets-jsr", "purl": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final", "type": "library", "group": "io.undertow", "version": "2.3.24.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ef0416b9-a698-5580-a702-53861c6d64e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ba54684f-2e86-5154-99db-bc7de73472b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:19a330d5-a43a-59b4-8273-6f362448fc4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:545e15cc-ee0e-5635-93f1-10208e946da6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12196 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:05d6e5c6-307a-5d44-a669-26ae5631d017", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1e90651b-3bb4-59d9-aa59-a98ae231c2d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a90c3615-305b-58e9-a62e-249e43a55ff2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2bfd94c3-76af-52f6-ac46-4f81eff7188a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1114 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:caaeb448-867e-5609-af47-bb578a1d00bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:28feefd9-0265-518f-90ba-940f8f63e359", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9ae64df2-98b9-5d4a-9048-fada029fd5e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c7e7901b-53b4-53ea-9b1c-bfee1cf50e02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9101d29b-e3ad-5fcb-ac67-89a6a2e76ee7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c81a33ad-bed8-5721-906a-8ef1287b682e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4f2f72e5-6d26-55b7-a07e-97d645734021", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:33f1ab4f-6282-50e1-a3b6-c6778cf68ae3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:183a5b97-3dda-5797-9ea5-c22633f38ca1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:27374a38-91a4-552a-bab2-a504fc23fc9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f544d650-e48b-5b88-8f55-ab37ef2287fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0842480e-a493-534d-816e-4052c94b2320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c04cd810-9e11-5b8b-a3cf-18272bf2911c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1718c1d2-61ca-5515-8826-481d7b7dda49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4041a969-6f86-5237-80ca-2a1f955e4aa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1aaf51e2-f467-583a-bcd4-be8b02046ea8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9bb53c46-e3e8-5991-916f-82e6f9bc07d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9b7cb2d0-f217-5d1b-94ef-8da9f910734c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9589ed3d-78dd-5a37-a042-cfee87f1a1f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3fc5e570-93d6-5a2c-8296-f751bbf9a361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1877c262-ba33-50e1-84d7-f22b07bbf71a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-4639 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c2c8f2a6-bcdf-5654-b74d-b3901a408e7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8e2594a3-c508-57e0-b648-128c523cf30f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:db2841bf-49f8-5965-bd9c-d0a75978eb86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4ca44101-6e35-514c-90a6-11109a2eb999", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c6c1b7e4-e5d9-5506-84ff-ffb88f941ef2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7238ae1b-d8dd-5bae-b6e3-1207730a1c3c", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-websockets-jsr 2.3.24.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:41e526d5-0842-516e-8739-514e13cdc29a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:342e6afe-89ea-5cac-a5d5-5b4c90efd769", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5a215159-b3ab-5cfa-8c1d-4873fb1293c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0147c773-42f2-560e-ac0e-00d0d844a5d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f8cb612d-e413-5c89-9af8-161cb322d81d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a3c5121e-e449-577d-b62a-cc0b6b88fbfb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3260 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr. already_fixed \u2014 The target repository (Undertow 2.3.24.Final) already contains the fix for CVE-2026-3260. The upstream fix (UNDERTOW-2677) was included in version 2.3.24.Final before it was onboarded to TuxCare. The fix prevents the multipart parser from overriding application-configured entity size limits.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@2.3.24.Final-tuxcare.1" } ] }