{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:318b8832-280f-581f-9bb4-bc5066a69e0d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "apache-activemq",
      "purl": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2",
      "version": "6.1.8-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "apache-activemq",
            "purl": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "6.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2012-6551",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bcaa6811-e2f5-5964-a686-457ab9818d00",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2012-6551 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq. not_affected \u2014 CVE-2012-6551: Target Apache ActiveMQ 6.1.8 is NOT AFFECTED. The vulnerability (demo web application enabled by default allowing DoS via resource exhaustion) was fixed in upstream Apache ActiveMQ 5.8.0 via commit 437ea2f6e (AMQ-4124). The fix removed the demo webapp from the default jetty.xml configuration, relocated demo files to webapps-demo/demo, and enabled authentication. This fix was alre...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-41678",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:096639ad-f7ca-51cf-9533-daa6d174a613",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-41678 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq. CVE-2022-41678 affects Jolokia's configuration allowing unrestricted JMX operations, enabling RCE via jdk.management.jfr.FlightRecorder MBean. The upstream vendor (Apache ActiveMQ) applied the fix in commit 6120169e5 (AMQ-9201) before version 6.1.8 was released. The target ships with the restrictive jolokia-access.xml configuration that: (1) whitelists only read-only commands (read, list, version, search), blocking write/exec operations; (2) explicitly denies access to jdk.management.jfr:type=FlightRecorder MBean used in the CVE exploit; (3) implements default-deny for dangerous operations. The fix is properly integrated into startup scripts via the jolokia.conf system property. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.16.6; >= 5.17.0, < 5.17.4), NVD (< 5.16.6; >= 5.17.0, < 5.17.4), cve.org (< 5.16.6; >= 5.17.0, < 5.17.4), Snyk (< 5.16.6; >= 5.17.0, < 5.17.4).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-32114",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4c22a9ac-a09e-5efc-902b-5dc52e938759",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-32114 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq. not_affected \u2014 CVE-2024-32114 concerns insecure default configuration in Apache ActiveMQ 6.x where the /api web context (Jolokia JMX REST API and Message REST API) was not protected by authentication. The target repository is Apache ActiveMQ version 6.1.8. The vulnerability was fixed in upstream version 6.1.2 (released April 11, 2024) via commit 09e3251c8 which changed the Jetty security constraint pathSpec f...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-66168",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cb36c134-2721-5d42-8110-6ed86ecc424d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-66168 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-108946",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f82cf91d-47d8-58ad-a237-e00b0655a91e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-108946 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-111821",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5bb4a978-f046-5a85-9a1f-9bd0c31bc745",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111821 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-111822",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:20ef2b1d-7784-5e8b-9c90-d9abedfe3765",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111822 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-39304",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9b9d6bb8-ee8d-53c5-8112-a9d09300fd37",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-39304 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-40046",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:28899421-fd40-5acb-8b3a-c07bcab670b4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40046 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-40466",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bdf1809c-f933-5e8e-a91e-b2513498be79",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40466 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-41043",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4fe8b847-f0de-56bc-8df5-4cca63bad9cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41043 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-41044",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5956946e-054d-5446-ad30-736336aeb04b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41044 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-42253",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0753444c-ac91-5f1e-a33f-1625bf6f8a2f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42253 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-42588",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f7e5cb8d-4d9c-538e-8068-28c949709377",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42588 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-45505",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b6dd0fe7-de10-5925-ae58-9c4c20751749",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45505 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-46605",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8d795991-3c39-53d1-8b12-3f5c02aa1d61",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46605 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-49157",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5f6fb48d-c0ed-599d-8a90-9017138b5c45",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49157 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-49270",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1cde7425-a011-5c28-aa20-9c9d2123f779",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49270 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-49432",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a5974ef1-9e8f-5636-b326-05a6b0c7ebd2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49432 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-49434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:61c338a0-3f77-5377-9fad-e33860615757",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49434 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-49877",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8cfbaad0-3a8f-5fa5-93bd-051ea67a3ba6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49877 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-50734",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:22d6cb92-7dab-5ef9-9007-f90067011ec2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50734 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-50750",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b6b0fc8d-d5ef-53d6-ae6e-1620e3fece34",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50750 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-52760",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9cb03f55-323e-5322-8bd8-4b016af5e012",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-52760 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-53916",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f60a6075-390f-5969-a155-e8a596496e57",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53916 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-53917",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:52ee96e0-8b86-5dc6-bcce-1d76501bb82c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53917 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-54475",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7a066131-2989-506b-9a69-b723468c3871",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54475 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-59878",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:879e4592-1d64-50a3-902f-5ebd41385af5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59878 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-61487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7d8b261d-c4e2-5020-be7f-928dffa0418a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-61487 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    },
    {
      "id": "CVE-2026-74761",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0a38e795-4189-5268-a807-29ea1f90b144",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-74761 affects version 6.1.8-tuxcare.2 of org.apache.activemq:apache-activemq."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.8-tuxcare.2"
    }
  ]
}