{
  "@id": "urn:uuid:c0f22e01-1dac-4b77-b842-098aefc7a108",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T18:48:55.110121+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-parser-generator@2.3.0.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-parser-generator@2.3.0.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-1259 affects version 2.3.0.Final-tuxcare.3 of io.undertow:undertow-parser-generator.",
      "vulnerability": {
        "name": "CVE-2022-1259"
      },
      "action_statement": "Vulnerability CVE-2022-1259 affects version 2.3.0.Final-tuxcare.3 of io.undertow:undertow-parser-generator."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-parser-generator@2.3.0.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-parser-generator@2.3.0.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-1319 does not affect version 2.3.0.Final-tuxcare.3 of io.undertow:undertow-parser-generator. already_fixed \u2014 CVE-2022-1319 (UNDERTOW-2060) has been fixed in the target repository. The fix commit eefae287893fc79736c9573975a9c96c3161cab0 from April 8, 2022 is present and contains both required defense mechanisms: (1) END_RESPONSE reuse flag changed from 1 to 0 to signal connection non-reusability after errors, and (2) removal of duplicate handleBadRequest() call to prevent sending two response packets.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-1319"
      },
      "impact_statement": "already_fixed \u2014 CVE-2022-1319 (UNDERTOW-2060) has been fixed in the target repository. The fix commit eefae287893fc79736c9573975a9c96c3161cab0 from April 8, 2022 is present and contains both required defense mechanisms: (1) END_RESPONSE reuse flag changed from 1 to 0 to signal connection non-reusability after errors, and (2) removal of duplicate handleBadRequest() call to prevent sending two response packets."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.undertow/undertow-parser-generator@2.3.0.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.undertow/undertow-parser-generator@2.3.0.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-2764 does not affect version 2.3.0.Final-tuxcare.3 of io.undertow:undertow-parser-generator. already_fixed \u2014 CVE-2022-2764 (UNDERTOW-2048) has already been fixed in the target repository. The fix was applied via commits 5f3b1f269, 05ab8777e, and f60972d29 on the master branch, implementing timeout protection for blocking read operations in UndertowInputStream.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2764"
      },
      "impact_statement": "already_fixed \u2014 CVE-2022-2764 (UNDERTOW-2048) has already been fixed in the target repository. The fix was applied via commits 5f3b1f269, 05ab8777e, and f60972d29 on the master branch, implementing timeout protection for blocking read operations in UndertowInputStream."
    }
  ]
}