{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a848b39b-12a1-5efe-976f-83ebb68f794d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "amqp-client",
      "purl": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2",
      "type": "library",
      "group": "com.rabbitmq",
      "bom-ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2",
      "version": "5.14.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "amqp-client",
            "purl": "pkg:maven/com.rabbitmq/amqp-client@5.14.3",
            "type": "library",
            "group": "com.rabbitmq",
            "version": "5.14.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-11087",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a1a9c57b-7bac-5313-8cd4-a6e41834d268",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11087 affects version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2023-46120",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:19ac4834-3692-5720-9e34-776bc329e174",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-46120 affects version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-106121",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:143b917a-f702-5b15-bb00-801e96246890",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106121 affects version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-106122",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:11884930-94ed-5fe8-ac19-3e2e7aff9c59",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106122 affects version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-106123",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b782d5ad-2a2e-5bd2-b563-9a2100dc3747",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106123 affects version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-61634",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5c7146fd-c689-584c-b84b-f04d4978b19a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-61634 affects version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63335",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b546cebd-8a62-5137-bb75-65b585c6ac80",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-63335 is fixed in version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63336",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:692ba24b-7b3b-5213-99b2-d6b0b5f0cd3a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-63336 is fixed in version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63337",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2e3048ca-6368-5199-8f6d-f21cbe40e209",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-63337 is fixed in version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-69219",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fb3e8b9c-056a-50a8-9a0a-3947b6a8301e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69219 is fixed in version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-69220",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:97d07695-1211-530a-ab87-eb19d0c6c82e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69220 affects version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-75516",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d48c3e49-3376-5f5e-9e4b-5b66c3582938",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-75516 does not affect version 5.14.3-tuxcare.2 of com.rabbitmq:amqp-client. not_affected \u2014 Version 5.14.3 is not affected by CVE-2026-75516. The vulnerability pattern described in the CVE (Math.min(maxInboundMessageBodySize, frameMax) defeating the size cap when frameMax=0) does not exist in this version. The code that introduces the vulnerability (_frameHandler.setFrameMax() and Utils.framePayloadLimit()) was added in a later version. In 5.14.3, maxInboundMessageBodySize is enforced...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.rabbitmq/amqp-client@5.14.3-tuxcare.2"
    }
  ]
}