{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:10f1628a-ccd8-56e9-99c7-aad1d55edea9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "artemis-server",
      "purl": "pkg:maven/org.apache.activemq/artemis-server@2.40.0-tuxcare.4",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/artemis-server@2.40.0-tuxcare.4",
      "version": "2.40.0-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "artemis-server",
            "purl": "pkg:maven/org.apache.activemq/artemis-server@2.40.0",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "2.40.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-35278",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-server@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:68e17e8d-f415-5b00-b0c2-61ab54a07dee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-35278 does not affect version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-server. not_affected \u2014 The target Apache ActiveMQ Artemis 2.40.0-tuxcare.3 is NOT AFFECTED by CVE-2022-35278 (XSS in web console via HTML in entity names). The vulnerability existed in the old artemis-hawtio web console module, which was fixed in upstream version 2.24.0 (commit ab1d7a218e by Apache developer brusdev@apache.org). Subsequently, the entire artemis-hawtio module was removed and replaced with a new consol...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-27427",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-server@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3009ded9-e968-51ad-a3fb-c45580969557",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-27427 does not affect version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-server. not_affected \u2014 CVE-2025-27427 is not present in Apache ActiveMQ Artemis 2.40.0-tuxcare.3. The vulnerability allowed users with createDurableQueue/createNonDurableQueue permissions to augment address routing-types without createAddress permission. The target contains the complete upstream fix from version 2.40.0, which added routing-type validation (commit 2216a75a57) and explicit routing-type specification fo...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-27446",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-server@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:8b5543fe-39b0-561b-8add-451214bd69f1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27446 is fixed in version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-server."
      }
    },
    {
      "id": "CVE-2026-49362",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-server@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4fb6a197-ff77-51dd-89a7-c7f848f65217",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-49362 is fixed in version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-server."
      }
    },
    {
      "id": "CVE-2026-49363",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-server@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:295db5ba-2a77-5f1b-a987-3e411f178af9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-49363 is fixed in version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-server."
      }
    },
    {
      "id": "CVE-2026-49364",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-server@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4720d08d-da4b-5d94-91be-795b12f71bf6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49364 affects version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-server."
      }
    },
    {
      "id": "CVE-2026-57967",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-server@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6cdc34e7-2635-5207-88b7-4f05924f45e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-57967 affects version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/artemis-server@2.40.0-tuxcare.4"
    }
  ]
}