{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b4a67813-4b31-5da8-ad86-d499cb5be055",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "artemis-core-client",
      "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.40.0-tuxcare.4",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.40.0-tuxcare.4",
      "version": "2.40.0-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "artemis-core-client",
            "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.40.0",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "2.40.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-4040",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b93478c7-a50f-59fe-a2cd-b0d05c575b04",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-4040 does not affect version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-core-client. not_affected \u2014 CVE-2021-4040 (ARTEMIS-3593) is not present in this target. The vulnerability was an OOM condition caused by maliciously crafted XID transaction data with inflated size fields. The upstream fix (commit 72a4fff167 by Clebert Suconic) added safeReadBytes() validation that checks claimedSize against actual buffer readableBytes before allocation. This fix was already present in Apache ActiveMQ Arte...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23913",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:bcf14897-578f-5d32-b328-dc8da9bb614f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23913 does not affect version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-core-client. The target Apache ActiveMQ Artemis 2.40.0-tuxcare.3 is NOT AFFECTED by CVE-2022-23913. The vulnerability (uncontrolled memory allocation when parsing XID transaction identifiers) was already fixed in the upstream Apache ActiveMQ Artemis release before TuxCare onboarded version 2.40.0. The fix commit (72a4fff167 \"ARTEMIS-3593 Defense against OME on parsing XID\") by upstream author clebertsuconic@apache.org introduced BufferHelper.safeReadBytes() to validate size fields before allocation, and XidCodecSupport.decodeXid() now uses this safe method. All XID parsing code paths in the target use the patched implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.19.1), NVD (< 2.19.1), cve.org (>= 2.19.0, < 2.19.1), Snyk (< 2.19.1; < 2.19.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-49364",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3f7319f5-71e7-5bc9-abad-ec1a96f1a573",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49364 affects version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-core-client."
      }
    },
    {
      "id": "CVE-2026-57822",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d5e38c4f-7f26-5283-ad22-12f6daca8eab",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-57822 is fixed in version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-core-client."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.40.0-tuxcare.4"
    }
  ]
}