{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b071cbf3-90be-5540-b7e2-2396e9052201", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1", "type": "library", "group": "com.rabbitmq", "bom-ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1", "version": "5.20.0-tuxcare.1", "pedigree": { "ancestors": [ { "name": "amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client@5.20.0", "type": "library", "group": "com.rabbitmq", "version": "5.20.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11087", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:f84df41c-3975-54c0-b5de-cce330748f6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11087 does not affect version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client. not_affected \u2014 CVE-2018-11087 concerns lack of TLS hostname verification in RabbitMQ Java Client, enabling man-in-the-middle attacks. The target version 5.20.0-tuxcare.1 contains the upstream vendor fix (commit 09a5334f, August 2018) that adds hostname verification capability via SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\"). This fix was already present in the upstream 5.20.0 release when TuxCare...", "justification": "code_not_present" } }, { "id": "CVE-2023-46120", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:beac89a7-be89-54f2-82ea-d9576e7ceb7c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-46120 does not affect version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client. not_affected \u2014 CVE-2023-46120 describes a DoS vulnerability where unbounded AMQP message sizes could cause OOM errors. The target repository (rabbitmq-java-client 5.20.0-tuxcare.1) is NOT AFFECTED because the vulnerability pattern was already removed by upstream commit 714aae602dcae6cb4b53cadf009323ebac313cc8, which shipped in the upstream 5.20.0 release that TuxCare onboarded. The fix adds comprehensive size...", "justification": "code_not_present" } }, { "id": "CVE-2026-106121", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:e837c43a-3a88-5e4c-a27c-76acbba0b8f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106121 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106122", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:f0640506-ca42-58fe-802d-612e5320a279", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106122 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106123", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:e3a0bbec-e838-5a77-8269-590d30e194f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106123 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-61634", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:ccb53d36-a28b-5b58-ad04-16cf5d87aa87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-61634 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63335", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:96e70c95-6548-5702-944e-a6122bc45a09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-63335 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63336", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:d501518f-381f-5cdc-9c4f-826d8b9e49b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-63336 is fixed in version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63337", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:a47f6c24-5611-5c27-a8fc-4e63c04d37ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-63337 is fixed in version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-69219", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:fed58163-50d5-5461-a5a3-0ddde7acfa18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69219 is fixed in version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-69220", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:894b70f2-c5b9-5c5e-80b1-b13cd773329a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69220 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-75516", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ], "bom-ref": "urn:uuid:91e030eb-e12d-533d-b058-fd8fac47929e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-75516 does not affect version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client. Target version 5.20.0 is NOT AFFECTED. The upstream vendor (RabbitMQ/VMware) already fixed this OOM vulnerability in commit 714aae60 (June 2023), which added a maxPayloadSize check to Frame.readFrom() before byte array allocation. This fix is included in version 5.20.0 (released October 2023). The CVE describes vulnerable code patterns (setFrameMax with Math.min, Utils.framePayloadLimit) that do not exist in this version. The defense at Frame.java:112-118 checks if payloadSize >= maxPayloadSize and throws IllegalStateException BEFORE allocating the byte array, preventing unbounded allocation regardless of the negotiated frameMax value. Default limit is 64MB (maxInboundMessageBodySize).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1" } ] }