{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bb957a0a-f70c-54dc-9f02-7556e6bd8813",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "artemis-core-client",
      "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.37.0-tuxcare.4",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.37.0-tuxcare.4",
      "version": "2.37.0-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "artemis-core-client",
            "purl": "pkg:maven/org.apache.activemq/artemis-core-client@2.37.0",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "2.37.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-4040",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.37.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:66a03959-f44d-5150-bc01-e61ab9c1a714",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-4040 does not affect version 2.37.0-tuxcare.4 of org.apache.activemq:artemis-core-client. not_affected \u2014 CVE-2021-4040 is NOT present in Apache ActiveMQ Artemis 2.37.0. The vulnerability involved unsafe XID decoding that could cause OOM via maliciously crafted transaction messages. The upstream fix (commit 72a4fff167, ARTEMIS-3593) was already included in Apache ActiveMQ Artemis 2.37.0 when TuxCare onboarded this version. The fix adds BufferHelper.safeReadBytes() which validates size fields before...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23913",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.37.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3f7a0b08-5fbe-5252-8772-d53a4203ece8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23913 does not affect version 2.37.0-tuxcare.4 of org.apache.activemq:artemis-core-client. CVE-2022-23913 is not present in this target. The vulnerability involved unsafe memory allocation when parsing XID (transaction ID) data from network buffers, potentially causing OutOfMemoryError and DoS. The upstream Apache ActiveMQ Artemis project fixed this in commit 72a4fff167 (ARTEMIS-3593) by introducing BufferHelper.safeReadBytes() which validates buffer sizes before allocation. This fix was already included in the upstream 2.37.0 release before TuxCare onboarded it (commit bbb3e48181 by evasilev@cloudlinux.com). The target code at SHA cab199b00c contains the complete fix with all three components: ActiveMQInvalidBufferException, BufferHelper.safeReadBytes(), and XidCodecSupport.decodeXid() using the safe method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.19.1), NVD (< 2.19.1), cve.org (>= 2.19.0, < 2.19.1), Snyk (< 2.19.1; < 2.19.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-49364",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.37.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:da881da6-5276-523c-811d-a6421013548f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49364 affects version 2.37.0-tuxcare.4 of org.apache.activemq:artemis-core-client."
      }
    },
    {
      "id": "CVE-2026-57822",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.37.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:cb6ba001-2e76-5e55-8929-13b3a4462b4d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-57822 is fixed in version 2.37.0-tuxcare.4 of org.apache.activemq:artemis-core-client."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/artemis-core-client@2.37.0-tuxcare.4"
    }
  ]
}