[Snyk] Security upgrade io.undertow:undertow-core from 2.0.9.Final to 2.3.21.Final by tyleragypt · Pull Request #158 · tyleragypt/JavaVulnerableLab

tyleragypt · 2026-02-05T14:11:20Z

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-IOUNDERTOW-15166617	635	io.undertow:undertow-core: `2.0.9.Final` -> `2.3.21.Final` `No Path Found` `No Known Exploit`

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-IOUNDERTOW-15166617

tyleragypt · 2026-02-05T14:15:40Z

Checkmarx One – Scan Summary & Details – c49e98f2-ccbe-4575-981a-e6292d2cbbd7

More results are available on the CxOne platform

Fixed Issues (97)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~CVE-2016-1000027~~	Maven-org.springframework:spring-webmvc-5.3.19
	~~CVE-2016-1000027~~	Maven-org.springframework:spring-web-5.3.19
	~~CVE-2021-28235~~	Go-go.etcd.io/etcd/server/v3-v3.5.0
	~~CVE-2022-1471~~	Maven-org.yaml:snakeyaml-1.29
	~~CVE-2022-1996~~	Go-github.com/emicklei/go-restful-v2.9.5
	~~CVE-2024-31573~~	Maven-org.xmlunit:xmlunit-core-2.8.4
	~~Cx0b915a4a-2d97~~	Npm-scs-0.0.1
	~~Cx18e041aa-8a63~~	Npm-node-ipc-9.2.2
	~~Cx4ca27ec0-0c96~~	Npm-scs-0.0.1
	~~Cx6bee2138-4df0~~	Npm-flow-dev-tools-99.10.9
	~~Cx8147ddef-ae09~~	Python-azure-powerbiembedded-6969.99.99
	~~Cx86e7ca06-a018~~	Python-not-particularly-2.5.0
	~~Cxae9d1b09-2adb~~	Npm-scs-0.0.1
	~~Cxbec87a55-fe55~~	Npm-node-ipc-9.2.2
	~~Cxccd8b30c-808c~~	Npm-scs-0.0.1
	~~Cxd55dbf56-4d06~~	Npm-scs-0.0.1
	~~CVE-2016-10707~~	Npm-jquery-1.6.4
	~~CVE-2017-1000048~~	Npm-qs-6.0.0
	~~CVE-2020-7212~~	Python-urllib3-1.25.7
	~~CVE-2021-33503~~	Python-urllib3-1.25.7
	~~CVE-2022-21698~~	Go-github.com/prometheus/client_golang-v1.11.0
	~~CVE-2022-24999~~	Npm-qs-6.0.0
	~~CVE-2022-25857~~	Maven-org.yaml:snakeyaml-1.29
	~~CVE-2022-27191~~	Go-golang.org/x/crypto-v0.0.0-20211202192323-5770296d904e
	~~CVE-2022-28948~~	Go-gopkg.in/yaml.v3-v3.0.0-20210107192922-496545a6307b
	~~CVE-2022-32149~~	Go-golang.org/x/text-v0.3.7
	~~CVE-2022-3248~~	Go-github.com/openshift/api-v0.0.0-20220315184754-d7c10d0b647e
	~~CVE-2022-41723~~	Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f
	~~CVE-2022-42003~~	Maven-com.fasterxml.jackson.core:jackson-databind-2.13.2.1
	~~CVE-2022-42004~~	Maven-com.fasterxml.jackson.core:jackson-databind-2.13.2.1
	~~CVE-2022-45143~~	Maven-org.apache.tomcat.embed:tomcat-embed-core-9.0.62
	~~CVE-2023-1370~~	Maven-net.minidev:json-smart-2.4.8
	~~CVE-2023-20860~~	Maven-org.springframework:spring-webmvc-5.3.19
	~~CVE-2023-20883~~	Maven-org.springframework.boot:spring-boot-autoconfigure-2.6.7
	~~CVE-2023-37788~~	Go-github.com/elazarl/goproxy-v0.0.0-20180725130230-947c36da3153
	~~CVE-2023-39325~~	Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f
	~~CVE-2023-43804~~	Python-urllib3-1.25.7
	~~CVE-2023-45142~~	Go-go.opentelemetry.io/contrib-v0.20.0
	~~CVE-2023-45142~~	Go-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp-v0.20.0
	~~CVE-2023-45288~~	Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f
	~~CVE-2023-46589~~	Maven-org.apache.tomcat.embed:tomcat-embed-core-9.0.62
	~~CVE-2023-47108~~	Go-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc-v0.20.0
	~~CVE-2023-47108~~	Go-go.opentelemetry.io/contrib-v0.20.0
	~~CVE-2023-6378~~	Maven-ch.qos.logback:logback-core-1.2.11
	~~CVE-2023-6378~~	Maven-ch.qos.logback:logback-classic-1.2.11
	~~CVE-2023-6481~~	Maven-ch.qos.logback:logback-core-1.2.11
	~~CVE-2024-22243~~	Maven-org.springframework:spring-web-5.3.19
	~~CVE-2024-22259~~	Maven-org.springframework:spring-web-5.3.19
	~~CVE-2024-22262~~	Maven-org.springframework:spring-web-5.3.19
	~~CVE-2024-23672~~	Maven-org.apache.tomcat.embed:tomcat-embed-core-9.0.62
	~~CVE-2024-23672~~	Maven-org.apache.tomcat.embed:tomcat-embed-websocket-9.0.62
	~~CVE-2024-24786~~	Go-google.golang.org/protobuf-v1.27.1
	~~CVE-2024-38809~~	Maven-org.springframework:spring-web-5.3.19
	~~Cx0a21eeca-49b1~~	Npm-scs-0.0.1
	~~Cx0eb7d3da-c52e~~	Python-azure-powerbiembedded-6969.99.99
	~~Cx4d89cd75-1e27~~	Python-azure-powerbiembedded-6969.99.99
	~~Cx6eb8ff4e-c9cf~~	Npm-flow-dev-tools-99.10.9
	~~Cx9f739bef-35bb~~	Npm-flow-dev-tools-99.10.9
	~~Cxb52dba53-66d2~~	Python-not-particularly-2.5.0
	~~Cxb667b900-bec1~~	Python-azure-powerbiembedded-6969.99.99
	~~Cxb6dee8d5-b814~~	Go-gopkg.in/square/go-jose.v2-v2.2.2
	~~Cxdca8e59f-8bfe~~	Npm-inflight-1.0.6
	~~CVE-2020-11022~~	Npm-jquery-1.6.4
	~~CVE-2020-26137~~	Python-urllib3-1.25.7

More results are available on the CxOne platform

Policy Management Violations (2)

Policy Name: Default policy

This is the default policy that applies to all projects in your account.

Rule Name: New vulnerabilities of Critical and High severity levels detected
Scanner: SAST,SCA,IaC-Security

Policy Name: No highs or mediums

Rule Name: No Highs or Mediums
Scanner: SAST
Entity: Vulnerability
Conditions(s): High > 0, Medium > 0

Issue	Source File / Package	Checkmarx Insight
Absolute_Path_Traversal	/src/main/webapp/vulnerability/idor/download.jsp: 18	Attack Vector
Client_DOM_XSS_from_AJAX	/src/main/webapp/vulnerability/Injection/xxe.jsp: 13	Attack Vector
Connection_String_Injection	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 121	Attack Vector
Connection_String_Injection	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 121	Attack Vector
Connection_String_Injection	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 112	Attack Vector
Improper_Restriction_of_XXE_Ref	/src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java: 48	Attack Vector
Reflected_XSS	/src/main/java/org/cysecurity/cspf/jvl/controller/xxe.java: 54	Attack Vector
Reflected_XSS	/src/main/webapp/login.jsp: 23	Attack Vector
Reflected_XSS	/src/main/webapp/login.jsp: 22	Attack Vector
Reflected_XSS	/src/main/webapp/vulnerability/UserDetails.jsp: 23	Attack Vector
Reflected_XSS	/src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java: 55	Attack Vector
Reflected_XSS	/src/main/webapp/vulnerability/xss/search.jsp: 21	Attack Vector
Reflected_XSS	/src/main/webapp/vulnerability/xss/xss4.jsp: 6	Attack Vector
Reflected_XSS	/src/main/webapp/vulnerability/xss/xss4.jsp: 15	Attack Vector
Reflected_XSS	/src/main/webapp/admin/adminlogin.jsp: 58	Attack Vector
Reflected_XSS	/src/main/webapp/login.jsp: 26	Attack Vector
Reflected_XSS	/src/main/webapp/vulnerability/SendMessage.jsp: 18	Attack Vector
Reflected_XSS	/src/main/webapp/vulnerability/SendMessage.jsp: 11	Attack Vector
Reflected_XSS	/src/main/webapp/vulnerability/Injection/xpath_login.jsp: 9	Attack Vector
Relative_Path_Traversal	/src/main/webapp/vulnerability/idor/download.jsp: 13	Attack Vector
Relative_Path_Traversal	/src/main/java/org/cysecurity/cspf/jvl/controller/AddPage.java: 45	Attack Vector
Relative_Path_Traversal	/src/main/java/org/cysecurity/cspf/jvl/controller/ForwardMe.java: 42	Attack Vector
Relative_Path_Traversal	/src/main/webapp/vulnerability/sqli/download_id.jsp: 32	Attack Vector
Relative_Path_Traversal	/src/main/webapp/vulnerability/sqli/download_id_union.jsp: 32	Attack Vector
Relative_Path_Traversal	/src/main/webapp/vulnerability/sqli/download_id.jsp: 37	Attack Vector
Relative_Path_Traversal	/src/main/webapp/vulnerability/sqli/download_id_union.jsp: 37	Attack Vector
SSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 112	Attack Vector
SSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 121	Attack Vector
SSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 121	Attack Vector
Unsafe_Reflection	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 111	Attack Vector
CSRF	/src/main/webapp/changeCardDetails.jsp: 43	Attack Vector
CSRF	/src/main/webapp/admin/manageusers.jsp: 14	Attack Vector
CSRF	/src/main/webapp/vulnerability/forum.jsp: 48	Attack Vector
CSRF	/src/main/webapp/vulnerability/forum.jsp: 48	Attack Vector
CSRF	/src/main/webapp/changeCardDetails.jsp: 43	Attack Vector
CSRF	/src/main/webapp/vulnerability/csrf/changepassword.jsp: 40	Attack Vector
CSRF	/src/main/webapp/vulnerability/csrf/changepassword.jsp: 40	Attack Vector
CSRF	/src/main/webapp/vulnerability/csrf/change-info.jsp: 31	Attack Vector
CSRF	/src/main/webapp/vulnerability/idor/change-email.jsp: 32	Attack Vector
CSRF	/src/main/webapp/vulnerability/forum.jsp: 48	Attack Vector
CSRF	/src/main/webapp/vulnerability/csrf/changepassword.jsp: 40	Attack Vector
CSRF	/src/main/webapp/changeCardDetails.jsp: 43	Attack Vector
CSRF	/src/main/webapp/vulnerability/csrf/change-info.jsp: 31	Attack Vector
CSRF	/src/main/webapp/changeCardDetails.jsp: 43	Attack Vector
CSRF	/src/main/webapp/vulnerability/csrf/change-info.jsp: 31	Attack Vector
CSRF	/src/main/webapp/vulnerability/csrf/changepassword.jsp: 40	Attack Vector
CSRF	/src/main/webapp/changeCardDetails.jsp: 43	Attack Vector
CSRF	/src/main/webapp/vulnerability/csrf/changepassword.jsp: 40	Attack Vector
CSRF	/src/main/webapp/changeCardDetails.jsp: 43	Attack Vector
CSRF	/src/main/webapp/vulnerability/csrf/change-info.jsp: 31	Attack Vector
CSRF	/src/main/webapp/vulnerability/idor/change-email.jsp: 32	Attack Vector
CSRF	/src/main/webapp/vulnerability/csrf/change-info.jsp: 31	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java: 58	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java: 54	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 127	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java: 58	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java: 54	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java: 58	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java: 54	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 127	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java: 59	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java: 58	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java: 58	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/SendMessage.java: 54	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 165	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 164	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 160	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 159	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 158	Attack Vector
CSRF	/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java: 153	Attack Vector

More results are available on the CxOne platform

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

fix: pom.xml to reduce vulnerabilities

ba699e9

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-IOUNDERTOW-15166617

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Security upgrade io.undertow:undertow-core from 2.0.9.Final to 2.3.21.Final#158

[Snyk] Security upgrade io.undertow:undertow-core from 2.0.9.Final to 2.3.21.Final#158
tyleragypt wants to merge 1 commit intomasterfrom
snyk-fix-b5b9cacaebc78c60f2ba0eec682706f7

tyleragypt commented Feb 5, 2026

Uh oh!

tyleragypt commented Feb 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

tyleragypt commented Feb 5, 2026

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

Vulnerabilities that will be fixed with an upgrade:

Uh oh!

tyleragypt commented Feb 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants