gitsafehub
github.com/kawasima/test-streamer ↗

kawasima/test-streamer

scanned 2026-08-06 · git f44d36e
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secretsVulnerable dependencies42Known OSS vulnerabilities44Risky code patternsMalicious dependenciesProject health

Security checks

Leaked secrets — Gitleaks none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivy 42 found · 4 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2019-10212 undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files
    client/pom.xml
    A package you depend on has a known security hole (CVE-2019-10212). Fix: Update that package to its patched version.
  • Serious CVE-2019-3888 undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed
    client/pom.xml
    A package you depend on has a known security hole (CVE-2019-3888). Fix: Update that package to its patched version.
  • Serious CVE-2022-4492 undertow: Server identity in https connection is not checked by the undertow client
    client/pom.xml
    A package you depend on has a known security hole (CVE-2022-4492). Fix: Update that package to its patched version.
  • Serious CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
    client/pom.xml
    A package you depend on has a known security hole (CVE-2025-12543). Fix: Update that package to its patched version.
  • Worth fixing CVE-2017-12165 undertow: improper whitespace parsing leading to potential HTTP request smuggling
    client/pom.xml
    A package you depend on has a known security hole (CVE-2017-12165). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-14888 undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS
    client/pom.xml
    A package you depend on has a known security hole (CVE-2019-14888). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-10705 undertow: Memory exhaustion issue in HttpReadListener via "Expect: 100-continue" header
    client/pom.xml
    A package you depend on has a known security hole (CVE-2020-10705). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability
    client/pom.xml
    A package you depend on has a known security hole (CVE-2020-1745). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-1757 undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass
    client/pom.xml
    A package you depend on has a known security hole (CVE-2020-1757). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-27782 undertow: special character in query results in server errors
    client/pom.xml
    A package you depend on has a known security hole (CVE-2020-27782). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-3629 undertow: potential security issue in flow control over HTTP/2 may lead to DOS
    client/pom.xml
    A package you depend on has a known security hole (CVE-2021-3629). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-3690 undertow: buffer leak on incoming websocket PONG message may lead to DoS
    client/pom.xml
    A package you depend on has a known security hole (CVE-2021-3690). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-3859 undertow: client side invocation timeout raised when calling over HTTP2
    client/pom.xml
    A package you depend on has a known security hole (CVE-2021-3859). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-2053 undertow: Large AJP request may cause DoS
    client/pom.xml
    A package you depend on has a known security hole (CVE-2022-2053). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-1108 Undertow: Infinite loop in SslConduit during close
    client/pom.xml
    A package you depend on has a known security hole (CVE-2023-1108). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-4639 undertow: Cookie Smuggling/Spoofing
    client/pom.xml
    A package you depend on has a known security hole (CVE-2023-4639). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-1635 undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol
    client/pom.xml
    A package you depend on has a known security hole (CVE-2024-1635). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-3884 undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded
    client/pom.xml
    A package you depend on has a known security hole (CVE-2024-3884). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-4027 undertow: OutOfMemoryError in HttpServletRequestImpl.getParameterNames() can cause remote DoS attacks
    client/pom.xml
    A package you depend on has a known security hole (CVE-2024-4027). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-5971 undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket
    client/pom.xml
    A package you depend on has a known security hole (CVE-2024-5971). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-6162 undertow: url-encoded request path information can be broken on ajp-listener
    client/pom.xml
    A package you depend on has a known security hole (CVE-2024-6162). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-7885 undertow: Improper State Management in Proxy Protocol parsing causes information leakage
    client/pom.xml
    A package you depend on has a known security hole (CVE-2024-7885). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-9784 undertow: Undertow MadeYouReset HTTP/2 DDoS Vulnerability
    client/pom.xml
    A package you depend on has a known security hole (CVE-2025-9784). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-7046 undertow: Long URL proxy request lead to java.nio.BufferOverflowException and DoS
    client/pom.xml
    A package you depend on has a known security hole (CVE-2016-7046). Fix: Update that package to its patched version.
  • Worth fixing CVE-2017-12196 undertow: Client can use bogus uri in Digest authentication
    client/pom.xml
    A package you depend on has a known security hole (CVE-2017-12196). Fix: Update that package to its patched version.
… 17 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scanner 44 found · 4 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-8vh8-vc28-m2hf Potential to access user credentials from the log files when debug logging enabled
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2019-10212). Fix: Update that package to its patched version.
  • Serious GHSA-j382-5jj3-vw4j Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2025-12543). Fix: Update that package to its patched version.
  • Serious GHSA-jwgx-9mmh-684w Credential exposure through log files in Undertow
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2019-3888). Fix: Update that package to its patched version.
  • Serious GHSA-pfcc-3g6r-8rg8 Undertow client not checking server identity presented by server certificate in https connections
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2022-4492). Fix: Update that package to its patched version.
  • Worth fixing GHSA-269g-pwp5-87pp TemporaryFolder on unix-like systems does not limit access to created files
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2020-15250). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2w73-fqqj-c92p Improper Input Validation in Undertow
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2020-1757). Fix: Update that package to its patched version.
  • Worth fixing GHSA-339q-62wm-c39w Undertow vulnerable to Denial of Service (DoS) attacks
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2021-3859). Fix: Update that package to its patched version.
  • Worth fixing GHSA-33hj-rcmx-86mv Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2024-4027). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3f57-w2rp-72fc Undertow Uncaught Exception vulnerability
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2016-7046). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jrv-jgp8-45v3 Undertow incorrectly parses cookies
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2023-4639). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3x3v-w654-m28m Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2026-3260). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5gg7-5wv8-4gcj Undertow Request Smuggling vulnerability
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2017-12165). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6h4f-pj3g-q8fq Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2024-3884). Fix: Update that package to its patched version.
  • Worth fixing GHSA-9442-gm4v-r222 Undertow's url-encoded request path information can be broken on ajp-listener
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2024-6162). Fix: Update that package to its patched version.
  • Worth fixing GHSA-95h4-w6j8-2rp8 Undertow MadeYouReset HTTP/2 DDoS Vulnerability
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2025-9784). Fix: Update that package to its patched version.
  • Worth fixing GHSA-95rf-557x-44g5 Undertow vulnerable to Dos via Large AJP request
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2022-2053). Fix: Update that package to its patched version.
  • Worth fixing GHSA-9623-mqmm-5rcf Undertow vulnerable to Race Condition
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2024-7885). Fix: Update that package to its patched version.
  • Worth fixing GHSA-97cq-f4jm-mv8h Undertow Denial of Service vulnerability
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2023-1973). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cccf-7xw3-p2vr HTTP Request Smuggling in Undertow
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2020-10719). Fix: Update that package to its patched version.
  • Worth fixing GHSA-ch7q-gpff-h9hp Undertow Missing Release of Memory after Effective Lifetime vulnerability
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2024-3653). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cp7v-vmv7-6x2q Incorrect Authorization in Undertow
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2017-12196). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fj7c-vg2v-ccrm Undertow vulnerable to memory exhaustion due to buffer leak
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2021-3690). Fix: Update that package to its patched version.
  • Worth fixing GHSA-g4cp-h53p-v3v8 Allocation of Resources Without Limits or Throttling in Undertow
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2020-10705). Fix: Update that package to its patched version.
  • Worth fixing GHSA-gjjx-gqm4-wcgm Uncontrolled Resource Consumption in Undertow
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2018-1114). Fix: Update that package to its patched version.
  • Worth fixing GHSA-gv2w-88hx-8m9r Improper Authorization in Undertoe
    /workdirs/scan-3c6b78f4-d6c1-47b5-bc34-79713a99d005/client/pom.xml
    A package you depend on has a known security hole (CVE-2020-1745). Fix: Update that package to its patched version.
… 19 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrep none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddog none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecard didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.