{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b02ad279-fe4c-572c-82dc-5ae210e3c5b1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2", "type": "library", "group": "com.rabbitmq", "bom-ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2", "version": "4.0.3-tuxcare.2", "pedigree": { "ancestors": [ { "name": "amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client@4.0.3", "type": "library", "group": "com.rabbitmq", "version": "4.0.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11087", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:ac2cf595-28d1-529e-b830-2b5ec4b65bc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11087 affects version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2023-46120", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:f51952aa-b21d-5843-a5bc-6ccf5d900f97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46120 affects version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106121", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:c1202aee-6c34-53e0-9eb0-d60da7c326ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106121 affects version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106122", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:8e028464-13b9-5ea8-8239-6bfa35e22900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106122 affects version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106123", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:0c339300-70b0-500d-95be-b012b422d6bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106123 affects version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-61634", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:6722626c-27f4-5a2e-b2a8-f16a51b06b8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-61634 affects version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63335", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:5ebbc628-71a7-5c7b-8b3f-855bb94ca0fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-63335 is fixed in version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63336", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:af6fb7fb-6dbc-530a-985f-a3d7606e6e73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-63336 is fixed in version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63337", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:905d6415-cdda-52be-8443-c9d497c865e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-63337 does not affect version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client. Version 4.0.3 does not contain the vulnerable code pattern described in CVE-2026-63337. The vulnerability requires a javaReturnType field in service descriptions that gets passed to Class.forName() with initialize=true, enabling arbitrary static initializer execution. That field, together with ProcedureDescription.computeReturnTypeAsJavaClass(), was introduced upstream in commit e28b34ad8094b47a7fa46112490d1308bf8418b9 (Adding Jackson support in JSON RPC) on 13 August 2018, over a year after version 4.0.3 was released on 7 June 2017. Version 4.0.3 uses a simpler service description protocol with only generic JSON-RPC types and has zero Class.forName calls in the JSON-RPC codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-69219", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:7c21e91f-76da-5f25-bcb9-0b6fce72a5f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69219 affects version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-69220", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:600b90c6-6dd1-593d-ad31-b4d11c2b2c7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69220 is fixed in version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-75516", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:01f8a520-ada9-5eb6-b99f-132255c41855", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-75516 does not affect version 4.0.3-tuxcare.2 of com.rabbitmq:amqp-client. not_affected \u2014 Version 4.0.3 (released June 2017) is NOT affected by CVE-2026-75516. The vulnerability describes a specific bug where `Math.min(maxInboundMessageBodySize, frameMax)` with `frameMax=0` defeats the `maxInboundMessageBodySize` protection mechanism. However, version 4.0.3 predates the introduction of the `maxInboundMessageBodySize` feature by 6 years (added June 2023 in commit 714aae60). The vulne...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.2" } ] }