False positive — Multiple Undertow CVEs reported but Undertow is not present in scanned artifact

[rrgupta-jii]

Describe the bug
Xray reports 9 Undertow CVEs against our project. However, io.undertow:undertow-core is NOT present in our delivery at all. The project uses Eclipse Jetty (9.4.58) as its HTTP server via Apache Karaf's Pax Web integration. There is no Undertow dependency, no AJP listener, and no XNIO anywhere in the dependency chain.

The scanner appears to be making a broad or incorrect component association.

CVEs incorrectly reported:

CVE	Severity	Vulnerability	Advisory
CVE-2023-1973	HIGH	Undertow memory exhaustion DoS	https://bugzilla.redhat.com/show_bug.cgi?id=2185662
CVE-2024-3884	HIGH	Undertow FormEncodedDataDefinition OOM	https://bugzilla.redhat.com/show_bug.cgi?id=2275287
CVE-2024-4027	HIGH	Undertow getParameterNames() OOM	https://bugzilla.redhat.com/show_bug.cgi?id=2276410
CVE-2024-5971	HIGH	Undertow chunked response DoS	https://bugzilla.redhat.com/show_bug.cgi?id=2292211
CVE-2024-6162	HIGH	Undertow AJP listener path confusion	https://bugzilla.redhat.com/show_bug.cgi?id=2293069
CVE-2024-7885	HIGH	Undertow Proxy Protocol info leakage	https://bugzilla.redhat.com/show_bug.cgi?id=2305290
CVE-2025-9784	HIGH	Undertow MadeYouReset DoS	https://nvd.nist.gov/vuln/detail/CVE-2025-9784
CVE-2025-12543	CRITICAL	Undertow Host header validation bypass	https://nvd.nist.gov/vuln/detail/CVE-2025-12543
CVE-2026-3260	HIGH	Undertow multipart/form-data DoS	https://bugzilla.redhat.com/show_bug.cgi?id=2443010
CVE-2026-28369	CRITICAL	Undertow HTTP request smuggling	https://bugzilla.redhat.com/show_bug.cgi?id=2443262

To Reproduce
Xray scan a Java application that uses Eclipse Jetty (not Undertow) as its HTTP server. Scanner reports Undertow CVEs despite the artifact not containing any Undertow dependencies.

Expected behavior
These CVEs should not be reported when io.undertow:undertow-core is not present in the scanned artifact's dependency tree. The project uses a completely different HTTP server (Jetty via Pax Web).

Versions

• Package: io.undertow:undertow-core — NOT PRESENT
• HTTP server actually used: org.eclipse.jetty:jetty-server:9.4.58 (via Pax Web 8.0.35)
• Container: Apache Karaf (OSGi)

Additional context
Verified via source code search: zero references to Undertow, XNIO, or AJP listener in the entire project. The scanner may be confusing artifact metadata or making overly broad vendor-level associations.