Skip to content

Bump io.undertow:undertow-core from 2.2.39.Final to 2.4.2.Final - #122

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/io.undertow-undertow-core-2.4.2.Final
Open

Bump io.undertow:undertow-core from 2.2.39.Final to 2.4.2.Final#122
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/io.undertow-undertow-core-2.4.2.Final

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps io.undertow:undertow-core from 2.2.39.Final to 2.4.2.Final.

Release notes

Sourced from io.undertow:undertow-core's releases.

v.2.4.1.Final

Release 2.4.1.Final Full list of Jiras: view in Jira

    # Release notes - Undertow - 2.4.1.Final

Bug

UNDERTOW-2763 As per RFC9112 reason-phrase is optional in HTTP 1.1 responses

Enhancement

UNDERTOW-2759 Enable testing in JDK25

UNDERTOW-2767 [2.4.x] UndertowMessages at core uses the wrong message id for fixes in new parser

v.2.4.0.Final

Release 2.4.0.Final Fixes CVE-2026-28367 CVE-2026-28368 CVE-2026-28369 Full list of Jiras: view in Jira

Release notes - Undertow - 2.4.0.Final

Feature Request

UNDERTOW-1593 Track processing time of in flight requests

UNDERTOW-1748 provide a way to "comment" a line in predicate language

UNDERTOW-1870 Hard-coded timeout for asynchronous HTTP requests - add async context timeout undertow option

UNDERTOW-1880 Undertow should support HTTP/2 connection management, wrt GOAWAY frame

UNDERTOW-1881 Add a new exchange attribute for SSL/TLS protocol version

UNDERTOW-2010 Provide method to invalidate all paths in CachingResourceManager

UNDERTOW-2242 Add UndertowOptions.ALLOW_ID_LESS_MATRIX_PARAMETERS

UNDERTOW-2273 Exchange Attribute parser doesn't handle nested attributes

UNDERTOW-2301 HTTP/2 cannot be configured on a per-listener basis

UNDERTOW-2319 Move io.undertow.multipart.minsize property to UndertowOptions

UNDERTOW-2553 Add rewriteHostHeader to ModCluster

UNDERTOW-2580 Support SameSite and custom cookie attributes

UNDERTOW-2696 Allow PathHandler to check for registered prefixes

... (truncated)

Commits
  • 92850b2 Prepare 2.4.2.Final
  • 8643d98 Merge pull request #1976 from ropalka/2026-06-23-backports-2.4.x
  • 5700856 [UNDERTOW-2709] UndertowOptions.ALLOWED_REQUEST_ATTRIBUTES_PATTERN is ignored...
  • f5f85e7 [UNDERTOW-2771] Revisited delimiters and unescaped characters
  • 7afc4df [UNDERTOW-2771] Decode query and path parameters if and only if parser is con...
  • 464418e [UNDERTOW-1918] ComplexSSLTestCase fails sporadically with ConnectionClosedEx...
  • 88734e1 Merge pull request #1973 from fl4via/backport-fixes_2.4.x
  • 665ff7f [UNDERTOW-2761] return 413 status instead of 500 in case of RequestTooBigExce...
  • e1daa7f [UNDERTOW-2759] Excluding new concurrency rules - they need further investiga...
  • 41c665f [UNDERTOW-2759] Excluding false positive - it is safe to have unread field no...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [io.undertow:undertow-core](https://github.com/undertow-io/undertow) from 2.2.39.Final to 2.4.2.Final.
- [Release notes](https://github.com/undertow-io/undertow/releases)
- [Commits](undertow-io/undertow@2.2.39.Final...2.4.2.Final)

---
updated-dependencies:
- dependency-name: io.undertow:undertow-core
  dependency-version: 2.4.2.Final
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Aug 10, 2026
@github-actions

Copy link
Copy Markdown

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output



Identified 204 dependencies

Detected 47 vulnerabilities (3 Critical, 14 High, 27 Medium, 3 Low)

+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                LIBRARY                 |       ID       |                                               TOP FIX                                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.84.jar                | CVE-2026-58062 | Upgrade to version org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,            |
|          |                                        |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,                                 |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.84.jar                | CVE-2026-59650 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                        |                | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.84.jar                | CVE-2026-8763  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-jdk15to18:1.85,      |
|          |                                        |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.1.3,                                     |
|          |                                        |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,                               |
|          |                                        |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.84.jar                | CVE-2026-12802 | Upgrade to version org.bouncycastle:bcpkix-lts8on:2.73.12,org.bouncycastle:bcpkix-fips:2.1.12,       |
|          |                                        |                | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-fips:1.0.12,                            |
|          |                                        |                | org.bouncycastle:bcpkix-fips:2.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                        |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.84.jar                | CVE-2026-59639 | Upgrade to version org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,      |
|          |                                        |                | org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                        |                | org.bouncycastle:bcpkix-fips:2.1.12,org.bouncycastle:bcpkix-fips:2.0.12,                             |
|          |                                        |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.84.jar                | CVE-2026-59642 | Upgrade to version org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-fips:2.0.12,          |
|          |                                        |                | org.bouncycastle:bcpkix-jdk15to18:1.85,org.bouncycastle:bcpkix-fips:2.1.12,                          |
|          |                                        |                | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,                         |
|          |                                        |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.84.jar                | CVE-2026-12803 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                        |                | org.bouncycastle:bcprov-lts8on:2.73.12, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.84.jar                | CVE-2026-12816 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                        |                | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.84.jar                | CVE-2026-12860 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,      |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.84.jar                | CVE-2026-13506 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,            |
|          |                                        |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-jdk18on:1.85 |
|          |                                        |                | ,org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85               |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.84.jar                | CVE-2026-14682 | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                        |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.0.2,                                     |
|          |                                        |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk15to18:1.85,                       |
|          |                                        |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.84.jar                | CVE-2026-58059 | Upgrade to version org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-lts8on:2.73.12,          |
|          |                                        |                | org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:2.0.2,  |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.84.jar                | CVE-2026-58060 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                        |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:2.0.2 |
|          |                                        |                | , https://github.com/bcgit/bc-java.git - r1rv85                                                      |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.84.jar                | CVE-2026-58061 | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                        |                | org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,                               |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:1.0.2.7,                             |
|          |                                        |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcutil-jdk18on-1.84.jar                | CVE-2026-59645 | Upgrade to version org.bouncycastle:bcutil-lts8on:2.73.12,org.bouncycastle:bcutil-fips:2.1.7,        |
|          |                                        |                | org.bouncycastle:bcutil-jdk18on:1.85,org.bouncycastle:bcutil-jdk15to18:1.85,                         |
|          |                                        |                | org.bouncycastle:bcutil-fips:2.0.7, https://github.com/bcgit/bc-java.git - r1rv85                    |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-core-25.0.3.jar               | CVE-2024-10039 | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-server-spi-private-25.0.3.jar | CVE-2026-2603  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.4.10,                              |
|          |                                        |                | https://github.com/keycloak/keycloak.git - 26.5.5                                                    |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcpkix-jdk18on-1.84.jar                | CVE-2026-13586 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,            |
|          |                                        |                | org.bouncycastle:bcpkix-jdk15to18:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,                       |
|          |                                        |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcpkix-jdk18on:1.85 |
|          |                                        |                | ,org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-jdk18on:1.85,                        |
|          |                                        |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcpkix-jdk18on-1.84.jar                | CVE-2026-15055 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcpkix-fips:2.1.12,       |
|          |                                        |                | org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcprov-jdk18on:1.85,                            |
|          |                                        |                | org.bouncycastle:bcpkix-lts8on:2.73.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                       |
|          |                                        |                | org.bouncycastle:bcpkix-fips:2.0.12,org.bouncycastle:bcpkix-jdk18on:1.85,                            |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcpkix-jdk18on-1.84.jar                | CVE-2026-59647 | Upgrade to version org.bouncycastle:bcpkix-lts8on:2.73.12,org.bouncycastle:bcpkix-jdk18on:1.85,      |
|          |                                        |                | org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcpkix-fips:2.0.12,                            |
|          |                                        |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcpkix-fips:2.1.12,                          |
|          |                                        |                | org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.84.jar                | CVE-2026-12185 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.84.jar                | CVE-2026-13586 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,            |
|          |                                        |                | org.bouncycastle:bcpkix-jdk15to18:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,                       |
|          |                                        |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcpkix-jdk18on:1.85 |
|          |                                        |                | ,org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-jdk18on:1.85,                        |
|          |                                        |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.84.jar                | CVE-2026-15055 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcpkix-fips:2.1.12,       |
|          |                                        |                | org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcprov-jdk18on:1.85,                            |
|          |                                        |                | org.bouncycastle:bcpkix-lts8on:2.73.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                       |
|          |                                        |                | org.bouncycastle:bcpkix-fips:2.0.12,org.bouncycastle:bcpkix-jdk18on:1.85,                            |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.84.jar                | CVE-2026-58063 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bc-fips:2.0.2,              |
|          |                                        |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-lts8on:2.73.12,                             |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:2.1.3,                               |
|          |                                        |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.84.jar                | CVE-2026-59647 | Upgrade to version org.bouncycastle:bcpkix-lts8on:2.73.12,org.bouncycastle:bcpkix-jdk18on:1.85,      |
|          |                                        |                | org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcpkix-fips:2.0.12,                            |
|          |                                        |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcpkix-fips:2.1.12,                          |
|          |                                        |                | org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.84.jar                | CVE-2026-59648 | Upgrade to version org.bouncycastle:bcpg-fips:1.0.13,org.bouncycastle:bcpg-jdk18on:1.85,             |
|          |                                        |                | org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,                         |
|          |                                        |                | org.bouncycastle:bcpg-jdk15to18:1.85,org.bouncycastle:bcpg-fips:2.0.13,                              |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcpg-lts8on:2.73.12,                         |
|          |                                        |                | org.bouncycastle:bcpg-fips:2.1.13, https://github.com/bcgit/bc-java.git - r1rv85                     |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.84.jar                | CVE-2026-59651 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,      |
|          |                                        |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | bcprov-jdk18on-1.84.jar                | CVE-2026-59652 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                        |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar            | CVE-2026-54515 | Upgrade to version  https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4,      |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.21.5,                                                  |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.22.1,                                                  |
|          |                                        |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.9,                         |
|          |                                        |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.21.5,                         |
|          |                                        |                | https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.22.1                          |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jackson-databind-2.22.0.jar            | CVE-2026-59889 | Upgrade to version com.fasterxml.jackson.core:jackson-databind:2.21.5,                               |
|          |                                        |                | tools.jackson.core:jackson-databind:3.1.5,tools.jackson.core:jackson-databind:3.2.1,                 |
|          |                                        |                | com.fasterxml.jackson.core:jackson-databind:2.22.1                                                   |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | jsoup-1.22.2.jar                       | CVE-2026-71497 | Upgrade to version org.jsoup:jsoup:1.23.1, https://github.com/jhy/jsoup.git - jsoup-1.23.1           |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-adapter-core-25.0.3.jar       | CVE-2026-1180  | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-common-25.0.3.jar             | CVE-2024-11736 | Upgrade to version org.keycloak:keycloak-saml-adapter-core:26.0.8;                                   |
|          |                                        |                | org.keycloak:keycloak-saml-adapter-core-jakarta:26.0.8;org.keycloak:keycloak-common:26.0.8;          |
|          |                                        |                | org.keycloak:keycloak-services:26.0.8;org.keycloak:keycloak-saml-core:26.0.8;                        |
|          |                                        |                | org.keycloak:keycloak-model-jpa:26.0.8;org.keycloak:keycloak-core:26.0.8                             |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-common-25.0.3.jar             | CVE-2024-9666  | Upgrade to version org.keycloak:keycloak-common:26.0.6, org.keycloak:keycloak-quarkus-server:26.0.6, |
|          |                                        |                | org.keycloak:keycloak-services:26.0.6                                                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-core-25.0.3.jar               | CVE-2024-11736 | Upgrade to version org.keycloak:keycloak-saml-adapter-core:26.0.8;                                   |
|          |                                        |                | org.keycloak:keycloak-saml-adapter-core-jakarta:26.0.8;org.keycloak:keycloak-common:26.0.8;          |
|          |                                        |                | org.keycloak:keycloak-services:26.0.8;org.keycloak:keycloak-saml-core:26.0.8;                        |
|          |                                        |                | org.keycloak:keycloak-model-jpa:26.0.8;org.keycloak:keycloak-core:26.0.8                             |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-core-25.0.3.jar               | CVE-2024-7318  | Upgrade to version org.keycloak:keycloak-core:24.0.7                                                 |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-core-25.0.3.jar               | CVE-2026-1180  | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2024-11734 | org.keycloak:keycloak-quarkus-server:26.0.8                                                          |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-0871  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.5.1                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-3190  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.5.6                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-37982 | org.keycloak:keycloak-services:26.6.2                                                                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-9704  | org.keycloak:keycloak-services:26.6.3,org.keycloak:keycloak-server-spi-private:26.6.3                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-9791  | org.keycloak:keycloak-server-spi-private:26.6.3,org.keycloak:keycloak-services:26.6.3                |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| MEDIUM   | keycloak-server-spi-private-25.0.3.jar | CVE-2026-9799  | Upgrade to version org.keycloak:keycloak-server-spi-private:26.6.4                                   |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | keycloak-core-25.0.3.jar               | CVE-2024-4028  | Upgrade to version org.keycloak:keycloak-core - 1.5.0-Final                                          |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | keycloak-core-25.0.3.jar               | CVE-2025-5416  | N/A                                                                                                  |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| LOW      | keycloak-server-spi-private-25.0.3.jar | CVE-2025-13881 | Upgrade to version org.keycloak:keycloak-server-spi-private:26.5.2,                                  |
|          |                                        |                | https://github.com/keycloak/keycloak.git - 26.5.2                                                    |
+----------+----------------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

quarkus-rest-client-jackson-3.38.1.jar
|-- resteasy-reactive-jackson-3.38.1.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- quarkus-rest-client-3.38.1.jar
	|-- quarkus-rest-client-jaxrs-3.38.1.jar
		|-- resteasy-reactive-client-3.38.1.jar
			|-- smallrye-mutiny-vertx-core-3.23.0.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
			|-- vertx-web-client-4.5.30.jar
				|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- quarkus-tls-registry-3.38.1.jar
		|-- smallrye-private-key-pem-parser-0.9.3.jar
			|-- bcpkix-jdk18on-1.84.jar [3 HIGH, 3 MEDIUM]
			|-- bcprov-jdk18on-1.84.jar [3 CRITICAL, 8 HIGH, 8 MEDIUM]
|-- quarkus-rest-jackson-common-3.38.1.jar
	|-- quarkus-jackson-3.38.1.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- vertx-core-4.5.30.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- quarkus-rest-common-3.38.1.jar
		|-- quarkus-vertx-3.38.1.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
org.eclipse.jgit.ssh.apache-7.7.1.202607240634-r.jar
|-- sshd-osgi-2.19.0.jar
	|-- bcpkix-jdk18on-1.84.jar [3 HIGH, 3 MEDIUM]
		|-- bcutil-jdk18on-1.84.jar [1 HIGH]
			|-- bcprov-jdk18on-1.84.jar [3 CRITICAL, 8 HIGH, 8 MEDIUM]
auth-3.5.1-SNAPSHOT.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jackson-datatype-jsr310-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- unirest-java-3.14.5.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- unirest-objectmapper-jackson-3.14.5.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- common-3.5.1-SNAPSHOT.jar
	|-- pnc-common-3.5.1.jar
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-datatype-jdk8-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jackson-module-parameter-names-2.22.0.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- jsoup-1.22.2.jar [1 MEDIUM]
	|-- rest-api-3.5.6-java-client.jar
		|-- dto-3.5.6.jar
			|-- jsoup-1.22.2.jar [1 MEDIUM]
		|-- pnc-api-3.5.2.jar
			|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- keycloak-installed-adapter-25.0.3.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
	|-- bcprov-jdk18on-1.84.jar [3 CRITICAL, 8 HIGH, 8 MEDIUM]
	|-- keycloak-adapter-core-25.0.3.jar [1 MEDIUM]
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- bcprov-jdk18on-1.84.jar [3 CRITICAL, 8 HIGH, 8 MEDIUM]
		|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- keycloak-crypto-default-25.0.3.jar
			|-- bcpkix-jdk18on-1.84.jar [3 HIGH, 3 MEDIUM]
			|-- bcprov-jdk18on-1.84.jar [3 CRITICAL, 8 HIGH, 8 MEDIUM]
			|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-private-25.0.3.jar [1 HIGH, 7 MEDIUM, 1 LOW]
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-25.0.3.jar
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
	|-- keycloak-adapter-spi-25.0.3.jar
		|-- bcprov-jdk18on-1.84.jar [3 CRITICAL, 8 HIGH, 8 MEDIUM]
	|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- jackson-databind-2.22.0.jar [2 MEDIUM]
		|-- keycloak-common-25.0.3.jar [2 MEDIUM]
config-3.5.1-SNAPSHOT.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]
|-- jackson-dataformat-yaml-2.22.0.jar
	|-- jackson-databind-2.22.0.jar [2 MEDIUM]
pom-manipulation-common-lite-5.5.jar
|-- jackson-databind-2.22.0.jar [2 MEDIUM]


No Policy violations were detected

Project 'rpm-importer' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=5a2834d6-2f49-478a-9592-197f95530bb7
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=1d6315cd961845d4879b0bbfd0912564f9875127d32e4533b36fef2b7e1a9e91

Mend AI scan succeeded.

Support Token: 037f85512e2ff472cbc28d7406a68d3051786358307361
SAST scan output
*no findings*

Full logs and artifacts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants