gitsafehub
github.com/lra/iri ↗

lra/iri

scanned 2026-08-09 · git 9dae9ea
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets2Vulnerable dependencies41Known OSS vulnerabilities45Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 2 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    README.md:55
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    README.md:55
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 41 found · 4 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2019-10212 undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files
    pom.xml
    A package you depend on has a known security hole (CVE-2019-10212). Fix: Update that package to its patched version.
  • Serious CVE-2019-3888 undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed
    pom.xml
    A package you depend on has a known security hole (CVE-2019-3888). Fix: Update that package to its patched version.
  • Serious CVE-2022-4492 undertow: Server identity in https connection is not checked by the undertow client
    pom.xml
    A package you depend on has a known security hole (CVE-2022-4492). Fix: Update that package to its patched version.
  • Serious CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
    pom.xml
    A package you depend on has a known security hole (CVE-2025-12543). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-6378 logback: serialization vulnerability in logback receiver
    pom.xml
    A package you depend on has a known security hole (CVE-2023-6378). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-25647 com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson
    pom.xml
    A package you depend on has a known security hole (CVE-2022-25647). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47554 apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader
    pom.xml
    A package you depend on has a known security hole (CVE-2024-47554). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
    pom.xml
    A package you depend on has a known security hole (CVE-2021-29425). Fix: Update that package to its patched version.
  • Worth fixing CVE-2017-12165 undertow: improper whitespace parsing leading to potential HTTP request smuggling
    pom.xml
    A package you depend on has a known security hole (CVE-2017-12165). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-14888 undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS
    pom.xml
    A package you depend on has a known security hole (CVE-2019-14888). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-10705 undertow: Memory exhaustion issue in HttpReadListener via "Expect: 100-continue" header
    pom.xml
    A package you depend on has a known security hole (CVE-2020-10705). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability
    pom.xml
    A package you depend on has a known security hole (CVE-2020-1745). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-1757 undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass
    pom.xml
    A package you depend on has a known security hole (CVE-2020-1757). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-27782 undertow: special character in query results in server errors
    pom.xml
    A package you depend on has a known security hole (CVE-2020-27782). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-3629 undertow: potential security issue in flow control over HTTP/2 may lead to DOS
    pom.xml
    A package you depend on has a known security hole (CVE-2021-3629). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-3690 undertow: buffer leak on incoming websocket PONG message may lead to DoS
    pom.xml
    A package you depend on has a known security hole (CVE-2021-3690). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-3859 undertow: client side invocation timeout raised when calling over HTTP2
    pom.xml
    A package you depend on has a known security hole (CVE-2021-3859). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-2053 undertow: Large AJP request may cause DoS
    pom.xml
    A package you depend on has a known security hole (CVE-2022-2053). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-1108 Undertow: Infinite loop in SslConduit during close
    pom.xml
    A package you depend on has a known security hole (CVE-2023-1108). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-4639 undertow: Cookie Smuggling/Spoofing
    pom.xml
    A package you depend on has a known security hole (CVE-2023-4639). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-1635 undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol
    pom.xml
    A package you depend on has a known security hole (CVE-2024-1635). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-3884 undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded
    pom.xml
    A package you depend on has a known security hole (CVE-2024-3884). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-4027 undertow: OutOfMemoryError in HttpServletRequestImpl.getParameterNames() can cause remote DoS attacks
    pom.xml
    A package you depend on has a known security hole (CVE-2024-4027). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-5971 undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket
    pom.xml
    A package you depend on has a known security hole (CVE-2024-5971). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-6162 undertow: url-encoded request path information can be broken on ajp-listener
    pom.xml
    A package you depend on has a known security hole (CVE-2024-6162). Fix: Update that package to its patched version.
… 16 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 45 found · 4 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-8vh8-vc28-m2hf Potential to access user credentials from the log files when debug logging enabled
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2019-10212). Fix: Update that package to its patched version.
  • Serious GHSA-j382-5jj3-vw4j Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2025-12543). Fix: Update that package to its patched version.
  • Serious GHSA-jwgx-9mmh-684w Credential exposure through log files in Undertow
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2019-3888). Fix: Update that package to its patched version.
  • Serious GHSA-pfcc-3g6r-8rg8 Undertow client not checking server identity presented by server certificate in https connections
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2022-4492). Fix: Update that package to its patched version.
  • Worth fixing GHSA-vmq6-5m68-f53m logback serialization vulnerability
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2023-6378). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4jrv-ppp4-jm57 Deserialization of Untrusted Data in Gson
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2022-25647). Fix: Update that package to its patched version.
  • Worth fixing GHSA-pfh2-hfmq-phg5 json-path Out-of-bounds Write vulnerability
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2023-51074). Fix: Update that package to its patched version.
  • Worth fixing GHSA-78wr-2p64-hpwj Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2024-47554). Fix: Update that package to its patched version.
  • Worth fixing GHSA-gwrp-pvrq-jmwv Path Traversal and Improper Input Validation in Apache Commons IO
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2021-29425). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2w73-fqqj-c92p Improper Input Validation in Undertow
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2020-1757). Fix: Update that package to its patched version.
  • Worth fixing GHSA-339q-62wm-c39w Undertow vulnerable to Denial of Service (DoS) attacks
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2021-3859). Fix: Update that package to its patched version.
  • Worth fixing GHSA-33hj-rcmx-86mv Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2024-4027). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jrv-jgp8-45v3 Undertow incorrectly parses cookies
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2023-4639). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3x3v-w654-m28m Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2026-3260). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5gg7-5wv8-4gcj Undertow Request Smuggling vulnerability
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2017-12165). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6h4f-pj3g-q8fq Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2024-3884). Fix: Update that package to its patched version.
  • Worth fixing GHSA-9442-gm4v-r222 Undertow's url-encoded request path information can be broken on ajp-listener
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2024-6162). Fix: Update that package to its patched version.
  • Worth fixing GHSA-95h4-w6j8-2rp8 Undertow MadeYouReset HTTP/2 DDoS Vulnerability
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2025-9784). Fix: Update that package to its patched version.
  • Worth fixing GHSA-95rf-557x-44g5 Undertow vulnerable to Dos via Large AJP request
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2022-2053). Fix: Update that package to its patched version.
  • Worth fixing GHSA-9623-mqmm-5rcf Undertow vulnerable to Race Condition
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2024-7885). Fix: Update that package to its patched version.
  • Worth fixing GHSA-97cq-f4jm-mv8h Undertow Denial of Service vulnerability
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2023-1973). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cccf-7xw3-p2vr HTTP Request Smuggling in Undertow
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2020-10719). Fix: Update that package to its patched version.
  • Worth fixing GHSA-ch7q-gpff-h9hp Undertow Missing Release of Memory after Effective Lifetime vulnerability
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2024-3653). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cp7v-vmv7-6x2q Incorrect Authorization in Undertow
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2017-12196). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fj7c-vg2v-ccrm Undertow vulnerable to memory exhaustion due to buffer leak
    /workdirs/scan-3add7654-1651-41fa-980f-8aad9345b9de/pom.xml
    A package you depend on has a known security hole (CVE-2021-3690). Fix: Update that package to its patched version.
… 20 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.