{
  "@id": "urn:uuid:e4698ab0-a1ab-4cf4-a919-5568e4c2c9fb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:11:56.518932+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-core-client@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T22:31:00.191049+00:00",
      "status_notes": "Vulnerability CVE-2021-4040 does not affect version 2.28.0-tuxcare.1 of org.apache.activemq:artemis-core-client. not_affected \u2014 CVE-2021-4040 is NOT present in Apache ActiveMQ Artemis 2.28.0. The vulnerability (OOM via maliciously crafted XID transaction ID fields with oversized buffer allocations) was fixed by upstream Apache in commit 72a4fff167 (ARTEMIS-3593) before the 2.28.0 release. TuxCare onboarded version 2.28.0 which already contained this upstream fix. The defense code (BufferHelper.safeReadBytes() with size ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-4040"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-4040 is NOT present in Apache ActiveMQ Artemis 2.28.0. The vulnerability (OOM via maliciously crafted XID transaction ID fields with oversized buffer allocations) was fixed by upstream Apache in commit 72a4fff167 (ARTEMIS-3593) before the 2.28.0 release. TuxCare onboarded version 2.28.0 which already contained this upstream fix. The defense code (BufferHelper.safeReadBytes() with size ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-core-client@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:11:56.518932+00:00",
      "status_notes": "Vulnerability CVE-2022-23913 does not affect version 2.28.0-tuxcare.1 of org.apache.activemq:artemis-core-client. CVE-2022-23913 is not present in Apache ActiveMQ Artemis 2.28.0. The vulnerability (uncontrolled memory consumption via unbounded byte array allocation when parsing XID transactions) was fixed by the upstream Apache project in commit 72a4fff167 (ARTEMIS-3593). This fix was already included in the upstream 2.28.0 release when TuxCare onboarded it. The vulnerable pattern (reading attacker-controlled size claims without validation before allocation) does not exist in the target - the code uses BufferHelper.safeReadBytes() which validates size constraints before allocating memory. Version 2.28.0 is well after the fixed versions (2.19.1, 2.20.0) mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.19.1), NVD (< 2.19.1), cve.org (>= 2.19.0, < 2.19.1), Snyk (< 2.19.1; < 2.19.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-23913"
      },
      "impact_statement": "CVE-2022-23913 is not present in Apache ActiveMQ Artemis 2.28.0. The vulnerability (uncontrolled memory consumption via unbounded byte array allocation when parsing XID transactions) was fixed by the upstream Apache project in commit 72a4fff167 (ARTEMIS-3593). This fix was already included in the upstream 2.28.0 release when TuxCare onboarded it. The vulnerable pattern (reading attacker-controlled size claims without validation before allocation) does not exist in the target - the code uses BufferHelper.safeReadBytes() which validates size constraints before allocating memory. Version 2.28.0 is well after the fixed versions (2.19.1, 2.20.0) mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.19.1), NVD (< 2.19.1), cve.org (>= 2.19.0, < 2.19.1), Snyk (< 2.19.1; < 2.19.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-core-client@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-49364 affects version 2.28.0-tuxcare.1 of org.apache.activemq:artemis-core-client.",
      "vulnerability": {
        "name": "CVE-2026-49364"
      },
      "action_statement": "Vulnerability CVE-2026-49364 affects version 2.28.0-tuxcare.1 of org.apache.activemq:artemis-core-client."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-core-client@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-57822 affects version 2.28.0-tuxcare.1 of org.apache.activemq:artemis-core-client.",
      "vulnerability": {
        "name": "CVE-2026-57822"
      },
      "action_statement": "Vulnerability CVE-2026-57822 affects version 2.28.0-tuxcare.1 of org.apache.activemq:artemis-core-client."
    }
  ]
}