jfrog / jfrog/artifactory-client-java
False positive — Multiple Undertow CVEs reported but Undertow is not present in scanned artifact
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 331
- Forks
- 163
- Avg merge
- 20h 9m
- Merged PRs (30d)
- 1
Description
Describe the bug
Xray reports 9 Undertow CVEs against our project. However, io.undertow:undertow-core is NOT present in our delivery at all. The project uses Eclipse Jetty (9.4.58) as its HTTP server via Apache Karaf's Pax Web integration. There is no Undertow dependency, no AJP listener, and no XNIO anywhere in the dependency chain.
The scanner appears to be making a broad or incorrect component association.
CVEs incorrectly reported:
| CVE | Severity | Vulnerability | Advisory |
|---|---|---|---|
| CVE-2023-1973 | HIGH | Undertow memory exhaustion DoS | https://bugzilla.redhat.com/show_bug.cgi?id=2185662 |
| CVE-2024-3884 | HIGH | Undertow FormEncodedDataDefinition OOM | https://bugzilla.redhat.com/show_bug.cgi?id=2275287 |
| CVE-2024-4027 | HIGH | Undertow getParameterNames() OOM | https://bugzilla.redhat.com/show_bug.cgi?id=2276410 |
| CVE-2024-5971 | HIGH | Undertow chunked response DoS | https://bugzilla.redhat.com/show_bug.cgi?id=2292211 |
| CVE-2024-6162 | HIGH | Undertow AJP listener path confusion | https://bugzilla.redhat.com/show_bug.cgi?id=2293069 |
| CVE-2024-7885 | HIGH | Undertow Proxy Protocol info leakage | https://bugzilla.redhat.com/show_bug.cgi?id=2305290 |
| CVE-2025-9784 | HIGH | Undertow MadeYouReset DoS | https://nvd.nist.gov/vuln/detail/CVE-2025-9784 |
| CVE-2025-12543 | CRITICAL | Undertow Host header validation bypass | https://nvd.nist.gov/vuln/detail/CVE-2025-12543 |
| CVE-2026-3260 | HIGH | Undertow multipart/form-data DoS | https://bugzilla.redhat.com/show_bug.cgi?id=2443010 |
| CVE-2026-28369 | CRITICAL | Undertow HTTP request smuggling | https://bugzilla.redhat.com/show_bug.cgi?id=2443262 |
To Reproduce
Xray scan a Java application that uses Eclipse Jetty (not Undertow) as its HTTP server. Scanner reports Undertow CVEs despite the artifact not containing any Undertow dependencies.
Expected behavior
These CVEs should not be reported when io.undertow:undertow-core is not present in the scanned artifact's dependency tree. The project uses a completely different HTTP server (Jetty via Pax Web).
Versions
- Package: io.undertow:undertow-core — NOT PRESENT
- HTTP server actually used: org.eclipse.jetty:jetty-server:9.4.58 (via Pax Web 8.0.35)
- Container: Apache Karaf (OSGi)
Additional context
Verified via source code search: zero references to Undertow, XNIO, or AJP listener in the entire project. The scanner may be confusing artifact metadata or making overly broad vendor-level associations.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository file or test is identified in the report. Start by reproducing an Xray scan for the Java application and inspecting its dependency tree; done means Undertow CVEs are absent when io.undertow:undertow-core is not present, while Jetty remains correctly identified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100