{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b3c58dbc-6ebe-535b-801a-2977b7406d84",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "artemis-openwire-protocol",
      "purl": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.28.0-tuxcare.1",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.28.0-tuxcare.1",
      "version": "2.28.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "artemis-openwire-protocol",
            "purl": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.28.0",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "2.28.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-26118",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.28.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2dc342b9-f9ca-5078-82b6-f29b78df50f9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-26118 does not affect version 2.28.0-tuxcare.1 of org.apache.activemq:artemis-openwire-protocol. Target version 2.28.0 is not affected by CVE-2021-26118. The upstream fix (commit e5566d5211 by Gary Tully) that removes the access control bypass for OpenWire advisory messages was already present in the upstream 2.28.0 release before TuxCare onboarding. The vulnerable code pattern (special advisory session with disabled security) has been removed and advisory messages are now routed through the PostOffice with proper access control.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.16.0), NVD (= 2.15.0), cve.org (< 2.16.0), Snyk (< 2.16.0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32642",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.28.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:895a5233-98e3-5235-b5aa-c2720a040247",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32642 affects version 2.28.0-tuxcare.1 of org.apache.activemq:artemis-openwire-protocol."
      }
    },
    {
      "id": "CVE-2026-67593",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.28.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cfde7356-f983-59af-8cf2-0d747223f447",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67593 affects version 2.28.0-tuxcare.1 of org.apache.activemq:artemis-openwire-protocol."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.28.0-tuxcare.1"
    }
  ]
}