{
  "@id": "urn:uuid:bca0b289-b9ca-4a24-9eba-6da8bb079154",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T22:30:09.588437+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T01:17:49.776988+00:00",
      "status_notes": "Vulnerability CVE-2020-10727 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client.",
      "vulnerability": {
        "name": "CVE-2020-10727"
      },
      "action_statement": "Vulnerability CVE-2020-10727 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T22:30:09.588437+00:00",
      "status_notes": "Vulnerability CVE-2021-4040 does not affect version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client. not_affected \u2014 CVE-2021-4040 (ARTEMIS-3593) is not present in this target. The vulnerability was an OOM condition caused by maliciously crafted XID transaction data with inflated size fields. The upstream fix (commit 72a4fff167 by Clebert Suconic) added safeReadBytes() validation that checks claimedSize against actual buffer readableBytes before allocation. This fix was already present in Apache ActiveMQ Arte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-4040"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-4040 (ARTEMIS-3593) is not present in this target. The vulnerability was an OOM condition caused by maliciously crafted XID transaction data with inflated size fields. The upstream fix (commit 72a4fff167 by Clebert Suconic) added safeReadBytes() validation that checks claimedSize against actual buffer readableBytes before allocation. This fix was already present in Apache ActiveMQ Arte..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2022-23913 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client.",
      "vulnerability": {
        "name": "CVE-2022-23913"
      },
      "action_statement": "Vulnerability CVE-2022-23913 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T21:29:49.692596+00:00",
      "status_notes": "Vulnerability CVE-2026-49364 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client.",
      "vulnerability": {
        "name": "CVE-2026-49364"
      },
      "action_statement": "Vulnerability CVE-2026-49364 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T21:29:49.692596+00:00",
      "status_notes": "Vulnerability CVE-2026-57822 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client.",
      "vulnerability": {
        "name": "CVE-2026-57822"
      },
      "action_statement": "Vulnerability CVE-2026-57822 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-jms-client@2.40.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T21:29:49.692596+00:00",
      "status_notes": "Vulnerability CVE-2026-75880 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client.",
      "vulnerability": {
        "name": "CVE-2026-75880"
      },
      "action_statement": "Vulnerability CVE-2026-75880 affects version 2.40.0-tuxcare.3 of org.apache.activemq:artemis-jms-client."
    }
  ]
}