{ "@id": "urn:uuid:7cf7dbb5-11dd-4b40-adc5-7792e9d94acd", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-31T22:30:09.588437+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-29T01:17:49.776988+00:00", "status_notes": "Vulnerability CVE-2020-10727 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples.", "vulnerability": { "name": "CVE-2020-10727" }, "action_statement": "Vulnerability CVE-2020-10727 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-31T22:30:09.588437+00:00", "status_notes": "Vulnerability CVE-2021-4040 does not affect version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples. not_affected \u2014 CVE-2021-4040 (ARTEMIS-3593) is not present in this target. The vulnerability was an OOM condition caused by maliciously crafted XID transaction data with inflated size fields. The upstream fix (commit 72a4fff167 by Clebert Suconic) added safeReadBytes() validation that checks claimedSize against actual buffer readableBytes before allocation. This fix was already present in Apache ActiveMQ Arte...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-4040" }, "impact_statement": "not_affected \u2014 CVE-2021-4040 (ARTEMIS-3593) is not present in this target. The vulnerability was an OOM condition caused by maliciously crafted XID transaction data with inflated size fields. The upstream fix (commit 72a4fff167 by Clebert Suconic) added safeReadBytes() validation that checks claimedSize against actual buffer readableBytes before allocation. This fix was already present in Apache ActiveMQ Arte..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2022-23913 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples.", "vulnerability": { "name": "CVE-2022-23913" }, "action_statement": "Vulnerability CVE-2022-23913 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-31T19:59:00.124035+00:00", "status_notes": "Vulnerability CVE-2022-35278 does not affect version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples. not_affected \u2014 The target Apache ActiveMQ Artemis 2.40.0-tuxcare.3 is NOT AFFECTED by CVE-2022-35278 (XSS in web console via HTML in entity names). The vulnerability existed in the old artemis-hawtio web console module, which was fixed in upstream version 2.24.0 (commit ab1d7a218e by Apache developer brusdev@apache.org). Subsequently, the entire artemis-hawtio module was removed and replaced with a new consol...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-35278" }, "impact_statement": "not_affected \u2014 The target Apache ActiveMQ Artemis 2.40.0-tuxcare.3 is NOT AFFECTED by CVE-2022-35278 (XSS in web console via HTML in entity names). The vulnerability existed in the old artemis-hawtio web console module, which was fixed in upstream version 2.24.0 (commit ab1d7a218e by Apache developer brusdev@apache.org). Subsequently, the entire artemis-hawtio module was removed and replaced with a new consol..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-31T20:02:00.094477+00:00", "status_notes": "Vulnerability CVE-2025-27427 does not affect version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples. not_affected \u2014 CVE-2025-27427 is not present in Apache ActiveMQ Artemis 2.40.0-tuxcare.3. The vulnerability allowed users with createDurableQueue/createNonDurableQueue permissions to augment address routing-types without createAddress permission. The target contains the complete upstream fix from version 2.40.0, which added routing-type validation (commit 2216a75a57) and explicit routing-type specification fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27427" }, "impact_statement": "not_affected \u2014 CVE-2025-27427 is not present in Apache ActiveMQ Artemis 2.40.0-tuxcare.3. The vulnerability allowed users with createDurableQueue/createNonDurableQueue permissions to augment address routing-types without createAddress permission. The target contains the complete upstream fix from version 2.40.0, which added routing-type validation (commit 2216a75a57) and explicit routing-type specification fo..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27446 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples.", "vulnerability": { "name": "CVE-2026-27446" }, "action_statement": "Vulnerability CVE-2026-27446 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-30T21:29:49.692596+00:00", "status_notes": "Vulnerability CVE-2026-49362 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples.", "vulnerability": { "name": "CVE-2026-49362" }, "action_statement": "Vulnerability CVE-2026-49362 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-30T21:32:31.619248+00:00", "status_notes": "Vulnerability CVE-2026-49363 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples.", "vulnerability": { "name": "CVE-2026-49363" }, "action_statement": "Vulnerability CVE-2026-49363 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-30T21:29:49.692596+00:00", "status_notes": "Vulnerability CVE-2026-49364 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples.", "vulnerability": { "name": "CVE-2026-49364" }, "action_statement": "Vulnerability CVE-2026-49364 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-30T21:29:49.692596+00:00", "status_notes": "Vulnerability CVE-2026-57822 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples.", "vulnerability": { "name": "CVE-2026-57822" }, "action_statement": "Vulnerability CVE-2026-57822 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-30T21:29:49.692596+00:00", "status_notes": "Vulnerability CVE-2026-57967 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples.", "vulnerability": { "name": "CVE-2026-57967" }, "action_statement": "Vulnerability CVE-2026-57967 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.activemq/artemis-image-examples@2.40.0-tuxcare.3" } } ], "timestamp": "2026-10-30T21:29:49.692596+00:00", "status_notes": "Vulnerability CVE-2026-75880 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples.", "vulnerability": { "name": "CVE-2026-75880" }, "action_statement": "Vulnerability CVE-2026-75880 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-image-examples." } ] }