{
  "@id": "urn:uuid:5eea5917-6558-41e4-8ff3-615731fcff78",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:08.804258+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-core-client@2.26.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.26.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T22:29:00.153894+00:00",
      "status_notes": "Vulnerability CVE-2021-4040 does not affect version 2.26.0-tuxcare.2 of org.apache.activemq:artemis-core-client. not_affected \u2014 CVE-2021-4040 (ARTEMIS-3593) is NOT present in the target. The vulnerability involved unbounded memory allocation during XID parsing when malicious clients sent crafted size fields, causing OOM. The fix (commit 72a4fff167) was already included in upstream Apache ActiveMQ Artemis 2.26.0 when TuxCare onboarded it. All three fix components are present: ActiveMQInvalidBufferException class, BufferH...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-4040"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-4040 (ARTEMIS-3593) is NOT present in the target. The vulnerability involved unbounded memory allocation during XID parsing when malicious clients sent crafted size fields, causing OOM. The fix (commit 72a4fff167) was already included in upstream Apache ActiveMQ Artemis 2.26.0 when TuxCare onboarded it. All three fix components are present: ActiveMQInvalidBufferException class, BufferH..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-core-client@2.26.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.26.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:09:40.812233+00:00",
      "status_notes": "Vulnerability CVE-2022-23913 does not affect version 2.26.0-tuxcare.2 of org.apache.activemq:artemis-core-client. CVE-2022-23913 is NOT present in Apache ActiveMQ Artemis 2.26.0-tuxcare.3. The vulnerability involved uncontrolled memory allocation during XID parsing that could cause DoS via OOM. The fix (commit 72a4fff167, ARTEMIS-3593) was authored by Apache committer Clebert Suconic and was already included in the upstream 2.26.0 release when TuxCare onboarded it. The target contains all three fix components: ActiveMQInvalidBufferException class, BufferHelper.safeReadBytes() validation method, and XidCodecSupport.decodeXid() using the safe method. No instances of the vulnerable pattern remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.19.1), NVD (< 2.19.1), cve.org (>= 2.19.0, < 2.19.1), Snyk (< 2.19.1; < 2.19.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-23913"
      },
      "impact_statement": "CVE-2022-23913 is NOT present in Apache ActiveMQ Artemis 2.26.0-tuxcare.3. The vulnerability involved uncontrolled memory allocation during XID parsing that could cause DoS via OOM. The fix (commit 72a4fff167, ARTEMIS-3593) was authored by Apache committer Clebert Suconic and was already included in the upstream 2.26.0 release when TuxCare onboarded it. The target contains all three fix components: ActiveMQInvalidBufferException class, BufferHelper.safeReadBytes() validation method, and XidCodecSupport.decodeXid() using the safe method. No instances of the vulnerable pattern remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.19.1), NVD (< 2.19.1), cve.org (>= 2.19.0, < 2.19.1), Snyk (< 2.19.1; < 2.19.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-core-client@2.26.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.26.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-49364 affects version 2.26.0-tuxcare.2 of org.apache.activemq:artemis-core-client.",
      "vulnerability": {
        "name": "CVE-2026-49364"
      },
      "action_statement": "Vulnerability CVE-2026-49364 affects version 2.26.0-tuxcare.2 of org.apache.activemq:artemis-core-client."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-core-client@2.26.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.26.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-57822 affects version 2.26.0-tuxcare.2 of org.apache.activemq:artemis-core-client.",
      "vulnerability": {
        "name": "CVE-2026-57822"
      },
      "action_statement": "Vulnerability CVE-2026-57822 affects version 2.26.0-tuxcare.2 of org.apache.activemq:artemis-core-client."
    }
  ]
}