{
  "@id": "urn:uuid:a67d2f75-7fd5-406e-85c1-e96792f5dbef",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:08.804258+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.26.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.26.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:46.571739+00:00",
      "status_notes": "Vulnerability CVE-2021-26118 does not affect version 2.26.0-tuxcare.3 of org.apache.activemq:artemis-openwire-protocol. The target repository (Apache ActiveMQ Artemis 2.26.0-tuxcare.3) is NOT AFFECTED by CVE-2021-26118. The vulnerability, which allowed advisory messages in the OpenWire protocol to bypass policy-based access control, was fixed in upstream commit e5566d5211 by routing advisory messages through the standard PostOffice mechanism instead of using a security-disabled advisory session. This fix was already present in the upstream 2.26.0 release before TuxCare onboarding (first TuxCare commit 74301bc3b6). The vulnerable code patterns (advisorySession field, addSession with internal parameter, disableSecurity call for advisory sessions) are absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.16.0), NVD (= 2.15.0), cve.org (< 2.16.0), Snyk (< 2.16.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-26118"
      },
      "impact_statement": "The target repository (Apache ActiveMQ Artemis 2.26.0-tuxcare.3) is NOT AFFECTED by CVE-2021-26118. The vulnerability, which allowed advisory messages in the OpenWire protocol to bypass policy-based access control, was fixed in upstream commit e5566d5211 by routing advisory messages through the standard PostOffice mechanism instead of using a security-disabled advisory session. This fix was already present in the upstream 2.26.0 release before TuxCare onboarding (first TuxCare commit 74301bc3b6). The vulnerable code patterns (advisorySession field, addSession with internal parameter, disableSecurity call for advisory sessions) are absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.16.0), NVD (= 2.15.0), cve.org (< 2.16.0), Snyk (< 2.16.0)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.26.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.26.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32642 affects version 2.26.0-tuxcare.3 of org.apache.activemq:artemis-openwire-protocol.",
      "vulnerability": {
        "name": "CVE-2026-32642"
      },
      "action_statement": "Vulnerability CVE-2026-32642 affects version 2.26.0-tuxcare.3 of org.apache.activemq:artemis-openwire-protocol."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.26.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/artemis-openwire-protocol@2.26.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-67593 affects version 2.26.0-tuxcare.3 of org.apache.activemq:artemis-openwire-protocol.",
      "vulnerability": {
        "name": "CVE-2026-67593"
      },
      "action_statement": "Vulnerability CVE-2026-67593 affects version 2.26.0-tuxcare.3 of org.apache.activemq:artemis-openwire-protocol."
    }
  ]
}