{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7e8d3899-57cd-5b89-9152-f65eeb304e30", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1", "type": "library", "group": "com.rabbitmq", "bom-ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1", "version": "5.26.0-tuxcare.1", "pedigree": { "ancestors": [ { "name": "amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client@5.26.0", "type": "library", "group": "com.rabbitmq", "version": "5.26.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11087", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:5ae3ba2a-bf36-5499-95a9-5ce04b2f347b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11087 does not affect version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client. not_affected \u2014 The target repository (rabbitmq-java-client v5.26.0) is NOT AFFECTED by CVE-2018-11087. The vulnerability concerns lack of hostname verification in TLS connections, but the target includes the upstream fix that adds hostname verification capability. This fix was introduced in upstream version 5.4.0 (August 2018) by Arnaud Cogolu\u00e8gnes and shipped in the upstream release that TuxCare onboarded. T...", "justification": "code_not_present" } }, { "id": "CVE-2023-46120", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:3d4fe858-862e-5634-89bf-b79f47c2b6e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-46120 does not affect version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client. not_affected \u2014 CVE-2023-46120 (unbounded message size causing OOM) is NOT present in rabbitmq-java-client 5.26.0. The upstream vendor fix adding maxInboundMessageBodySize validation (default 64 MiB limit) was already included in the upstream 5.26.0 release that TuxCare onboarded. The defense code rejects oversized messages before allocation in three locations: CommandAssembler, Frame, and FrameBuilder. Fix co...", "justification": "code_not_present" } }, { "id": "CVE-2026-106121", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:f0cf85f8-608c-5737-8cd0-edb011f44c63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106121 affects version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106122", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:19fb948b-92c7-5c85-806e-09381ce55f24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106122 affects version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106123", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:39ee5ce0-213c-5d68-82d8-e5fca839bd25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106123 affects version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-61634", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:3d043a28-90fe-532b-b7f2-1cf7027575f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-61634 affects version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63335", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:a752d00f-b961-50b4-8106-6e2bc87a58fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-63335 affects version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63336", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:3d532553-8a1b-5dda-9737-c30ba2526973", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-63336 affects version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63337", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:3bd520cf-bbc4-514b-8f93-6ac735aedb62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-63337 affects version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-69219", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:a0b89ae9-37f8-5b64-b800-03e191359440", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69219 is fixed in version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-69220", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:228869b6-c481-53dd-9840-590132988ff3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69220 affects version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-75516", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:a048de64-1244-5b9d-8420-51e264a535e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-75516 does not affect version 5.26.0-tuxcare.1 of com.rabbitmq:amqp-client. not_affected \u2014 Version 5.26.0 has a fundamentally different architecture than the patched versions. The vulnerable code pattern (_frameHandler.setFrameMax with Math.min defeating the 64MB cap when frameMax=0) does not exist. The FrameHandler interface lacks setFrameMax(), and Utils.inboundFrameMax()/framePayloadLimit() methods are absent. The negotiated frameMax is stored in AMQConnection._frameMax but never ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@5.26.0-tuxcare.1" } ] }