{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9bd9f2e9-ffa7-5edb-8a14-45df32f3f446", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "activemq-broker", "purl": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2", "type": "library", "group": "org.apache.activemq", "bom-ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2", "version": "6.1.6-tuxcare.2", "pedigree": { "ancestors": [ { "name": "activemq-broker", "purl": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6", "type": "library", "group": "org.apache.activemq", "version": "6.1.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-3600", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:5967c360-b3d0-56d4-a5ee-31a04a0f538b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3600 does not affect version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker. CVE-2014-3600 affects Apache ActiveMQ 5.x before 5.10.1. The target (ActiveMQ 6.1.6) already contains the upstream XXE protection fix (commit b9696ac80) introduced by Apache developer Dejan Bosanac in August 2014. The fix configures DocumentBuilderFactory with three critical security features (disable external-general-entities, disable external-parameter-entities, disallow-doctype-decl) before parsing any XML content in XPath-based message selectors. This fix was already present in the upstream 6.1.6 release that TuxCare onboarded, verified by confirming the fix commit is an ancestor of the first TuxCare onboarding commit (974edcfe4). The vulnerable pattern (unsafe XML parsing allowing XXE attacks) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1), NVD (= 5.0.0; = 5.1.0; = 5.2.0; = 5.3.0; = 5.3.1; = 5.3.2; = 5.4.0; = 5.4.1; = 5.4.2; = 5.4.3; = 5.5.0; = 5.5.1; = 5.6.0; = 5.7.0; = 5.8.0; = 5.9.0; = 5.9.1; = 5.10.0), Snyk (>= 5, < 5.10.1; >= 5, < 5.10.1; >= 5.0.0, < 5.10.1).", "justification": "code_not_present" } }, { "id": "CVE-2014-3612", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:1aeab2dc-262b-557c-8cd8-f119a1dbd157", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3612 does not affect version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker. CVE-2014-3612 is not present in Apache ActiveMQ 6.1.6. The vulnerability allowed authentication bypass via empty password triggering unauthenticated LDAP bind. The upstream fix (commit 0b5231ada from September 2014) was already present in the ActiveMQ 6.1.6 release that TuxCare onboarded. All LDAP authentication modules (LDAPLoginModule, LDAPAuthorizationMap, SimpleCachedLDAPAuthorizationMap, LdapNetworkConnector) contain explicit validation that rejects empty username or empty password before LDAP bind operations, throwing NamingException with message \"Empty username is not allowed\" or \"Empty password is not allowed\". The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1), NVD (= 5.0.0; = 5.1.0; = 5.2.0; = 5.3.0; = 5.3.1; = 5.3.2; = 5.4.0; = 5.4.1; = 5.4.2; = 5.4.3; = 5.5.0; = 5.5.1; = 5.6.0; = 5.7.0; = 5.8.0; = 5.9.0; = 5.9.1; = 5.10.0), Snyk (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1; <= 0; >= 5.0.0, < 5.10.1; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2015-6524", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:c67ec77f-700d-5bbe-beef-e301572ad9a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-6524 does not affect version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker. not_affected \u2014 CVE-2015-6524 does not affect this version. The vulnerability (LDAP filter injection via unescaped wildcards in usernames) was fixed in upstream Apache ActiveMQ commit 0b5231ada (AMQ-5345) by Dejan Bosanac, which was already present in ActiveMQ 6.1.6 when TuxCare onboarded it. The fix applies RFC 2254 encoding to usernames before LDAP filter construction, converting wildcards like '*' to '\\2a',...", "justification": "code_not_present" } }, { "id": "CVE-2026-108946", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:01a09f58-ce40-5cdb-a962-e1e2cb8d01d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-108946 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-108949", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:7df43945-52df-5e83-9949-e146af7448bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-108949 does not affect version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker. not_affected \u2014 ActiveMQ 6.1.6 broker does not reject a ConsumerInfo for another connection's temp destination after registering the subscription. TempQueue/TempTopic.addSubscription transfer ownership instead of throwing, and the only InvalidDestinationException for temp destinations is client-side. AbstractRegion.addConsumer does clean up (subscriptions.remove) on the SecurityException path after subscriptio...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-33227", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:fc8f7bb0-3d06-5545-b926-caa873f917a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33227 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-34197", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:586ef862-26fe-58d1-8825-a1464626c7e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34197 is fixed in version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-39304", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:c5a04582-9ab7-55aa-8a0c-f53a6509b503", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-39304 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-40466", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:70d74b63-044d-5317-9477-323c5d01f6de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40466 is fixed in version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-41043", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:bb425142-95db-5d32-8934-7e80f9a6c486", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41043 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-41044", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:d1ee2690-385c-5d47-8e34-209303a81a9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41044 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-42588", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:71dfcb64-a212-506f-a7af-336fe6394c03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42588 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-45505", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:4b1b1c6c-fedd-5e50-822e-660d116b69a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45505 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-49270", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:efbe1477-4184-59dc-8c12-d26b7b7195f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49270 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-49434", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:bffff77e-5af9-57ef-8ef1-1201792258ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49434 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-50750", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:e629c6d8-ac1b-577c-ba96-ed264a94f55f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50750 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-53917", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:134076ef-aa8d-5b40-8152-8ea72f9d4eed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53917 is fixed in version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-54475", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:2432c9d3-bdbf-5a20-9d0d-8e848df765a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54475 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-61487", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:df08efda-c5e0-5fbe-ae2e-107ce648186e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-61487 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-74761", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:536ce97b-3e8f-55c5-b424-a25289cedef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-74761 affects version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-broker." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.6-tuxcare.2" } ] }