{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ff15d79f-7527-56f2-be1c-15b5761aa5e2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "activemq-broker", "purl": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2", "type": "library", "group": "org.apache.activemq", "bom-ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2", "version": "6.1.8-tuxcare.2", "pedigree": { "ancestors": [ { "name": "activemq-broker", "purl": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8", "type": "library", "group": "org.apache.activemq", "version": "6.1.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-3600", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:46adce23-9e4d-5c98-bfcc-3dda50359491", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3600 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker. CVE-2014-3600 (XXE vulnerability in XPath-based message selectors) is NOT present in Apache ActiveMQ 6.1.8-tuxcare.2. The upstream fix (commit b9696ac80 from August 2014) was already included in ActiveMQ 6.1.8 before TuxCare onboarded this version. The fix configures DocumentBuilderFactory with XXE-protection features: disables external-general-entities, external-parameter-entities, and disallows DOCTYPE declarations. The secured DocumentBuilder is used by both JAXPXPathEvaluator and XalanXPathEvaluator when parsing XML messages, preventing external entity resolution attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1), NVD (= 5.0.0; = 5.1.0; = 5.2.0; = 5.3.0; = 5.3.1; = 5.3.2; = 5.4.0; = 5.4.1; = 5.4.2; = 5.4.3; = 5.5.0; = 5.5.1; = 5.6.0; = 5.7.0; = 5.8.0; = 5.9.0; = 5.9.1; = 5.10.0), Snyk (>= 5, < 5.10.1; >= 5, < 5.10.1; >= 5.0.0, < 5.10.1).", "justification": "code_not_present" } }, { "id": "CVE-2014-3612", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:ad1b1dff-b196-5d00-9a29-d1ced7043d79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3612 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker. CVE-2014-3612 (LDAP authentication bypass via empty password) is NOT present in this Apache ActiveMQ 6.1.8 target. The upstream vendor fix (commit 0b5231ada from 2014-09-08, AMQ-5345) was already included in the Apache ActiveMQ 6.1.8 release that TuxCare onboarded. The vulnerable code pattern allowing empty passwords in LDAP bind operations has been replaced with explicit validation that rejects empty username or password values.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1), NVD (= 5.0.0; = 5.1.0; = 5.2.0; = 5.3.0; = 5.3.1; = 5.3.2; = 5.4.0; = 5.4.1; = 5.4.2; = 5.4.3; = 5.5.0; = 5.5.1; = 5.6.0; = 5.7.0; = 5.8.0; = 5.9.0; = 5.9.1; = 5.10.0), Snyk (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1; <= 0; >= 5.0.0, < 5.10.1; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2015-6524", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:b3079bcc-8fea-5c4e-9e90-3e7878c9693d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-6524 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker. not_affected \u2014 CVE-2015-6524 is NOT present in target ActiveMQ 6.1.8. The vulnerability (LDAP filter injection via unencoded usernames allowing wildcard brute force attacks) was fixed in upstream commit 0b5231ada (AMQ-5345) dated 2014-09-08, which was already included in the upstream ActiveMQ 6.1.8 release when TuxCare onboarded it on 2026-07-22. The fix applies RFC 2254 encoding to usernames before LDAP filt...", "justification": "code_not_present" } }, { "id": "CVE-2026-108946", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:20970b34-6fd0-5975-ad0d-92f26a796e70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-108946 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-108949", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:6c910022-c896-5ab8-be2b-2edda39b204b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-108949 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker. not_affected \u2014 Not affected (Type A2). The CVE's leak needs the broker to reject a ConsumerInfo for a temp destination owned by another connection after the Subscription was put into the region's subscriptions map. In 6.1.8 the broker never rejects that request. TempQueue and TempTopic addSubscription silently reassign ownership, and the \"Cannot use a Temporary destination from another Connection\" InvalidDest...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-33227", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:4d797c33-e2db-5ebc-b393-aae6d8040235", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33227 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-34197", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:8b7be364-7ba7-515d-a111-22bf33eccaf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34197 is fixed in version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-39304", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:fbee086f-29c6-5515-8bc7-d54f00fe8932", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-39304 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-40466", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:680a9544-e2c0-5a3a-b9c1-9d3c7ff8a378", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40466 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-41043", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:94a68a9b-b5e4-577b-852f-338b8b4696c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41043 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-41044", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:ed31f227-92bf-501a-820f-0f6162e63c7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41044 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-42588", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:e51cd00c-6a8c-5e3e-95b1-1637c365ca5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42588 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-45505", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:e169ff00-cb6b-58a6-ba66-2a9c6fe960ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45505 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-49270", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:92783b7d-5eee-589c-ad81-3463739425bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49270 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-49434", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:1ecec730-6474-58c1-b95a-30cda1c4df23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49434 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-50750", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:cfcea2ac-12bc-5b1e-87fe-a099a3d99bdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50750 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-53917", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:242f3f42-d9fc-5368-8e46-8d673d477629", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53917 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-54475", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:547b97c9-bb62-5f58-b13b-547bf9bc600c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54475 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-61487", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:7bdb763b-acee-5ac3-9b7d-60379e3259e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-61487 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } }, { "id": "CVE-2026-74761", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:fde6ebfc-2672-5b3f-9f6d-71251102905b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-74761 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-broker." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.activemq/activemq-broker@6.1.8-tuxcare.2" } ] }