{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cbea576e-2eee-5098-935e-647b09158e63", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2", "type": "library", "group": "com.rabbitmq", "bom-ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2", "version": "5.19.0-tuxcare.2", "pedigree": { "ancestors": [ { "name": "amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client@5.19.0", "type": "library", "group": "com.rabbitmq", "version": "5.19.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11087", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:7f3e730a-ff3b-5b3b-85d4-b2eee2954d3d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11087 does not affect version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client. not_affected \u2014 CVE-2018-11087 affects Pivotal Spring AMQP due to lack of hostname verification in its dependency, rabbitmq-java-client. The target repository IS rabbitmq-java-client version 5.19.0-tuxcare.2. The upstream fix (commit 09a5334f by Arnaud Cogolu\u00e8gnes, dated Aug 20, 2018) added the enableHostnameVerification() method with SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\"). This fix was alre...", "justification": "code_not_present" } }, { "id": "CVE-2023-46120", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:28a87769-98e4-543a-bdab-4ce5a5c9071b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-46120 does not affect version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client. not_affected \u2014 The target repository rabbitmq-java-client version 5.19.0-tuxcare.2 is NOT vulnerable to CVE-2023-46120. The vulnerability pattern (unbounded memory allocation for inbound AMQP messages leading to OOM) is not present because the upstream vendor's fix was already included in the 5.19.0 release that TuxCare onboarded on 2026-08-31. The fix (commit 714aae602dcae6cb4b53cadf009323ebac313cc8, authore...", "justification": "code_not_present" } }, { "id": "CVE-2026-106121", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:ce1109cd-c53e-5f96-b95a-113723808897", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106121 affects version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106122", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:54664dbe-22c2-5f18-834e-f5bfa75a130b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106122 affects version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106123", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:4fe919cf-47fd-5ebe-8437-04ebbb2b75dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106123 affects version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-61634", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:e0157e6c-76f2-5d9a-9860-8a6a49bbb987", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-61634 is fixed in version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63335", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:0a354719-7e47-55e6-88f7-18f0eec87a98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-63335 is fixed in version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63336", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:4e21b8ff-6425-5ad0-a9f7-fcff95580124", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-63336 is fixed in version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63337", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:a165fad3-1e4d-5d2c-bc23-4cc720137276", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-63337 is fixed in version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-69219", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:3bf0a38d-ac42-542f-932a-38c5623f636c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69219 is fixed in version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-69220", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:aec1e5a5-9613-5f12-a5ac-5c1ba8f29774", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69220 is fixed in version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-75516", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ], "bom-ref": "urn:uuid:69aa65c9-1fa9-565d-bb98-abd08415b175", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-75516 does not affect version 5.19.0-tuxcare.2 of com.rabbitmq:amqp-client. not_affected \u2014 Version 5.19.0 is not affected by CVE-2026-75516. The vulnerability requires a setFrameMax() mechanism that applies the negotiated frameMax to inbound frame size limits, but this mechanism does not exist in version 5.19.0. The target receives the INPUT (negotiated frameMax from Connection.Tune) but has no code path that reaches the GOAL (memory exhaustion via unbounded allocation). Inbound fram...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.19.0-tuxcare.2" } ] }