{
  "@id": "urn:uuid:538e84b0-dd43-407a-a740-6b61776b77cc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T22:31:00.191049+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.broker/last-value-queue@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.broker/last-value-queue@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T22:31:00.191049+00:00",
      "status_notes": "Vulnerability CVE-2021-4040 does not affect version 2.28.0-tuxcare.1 of org.apache.activemq.examples.broker:last-value-queue. not_affected \u2014 CVE-2021-4040 is NOT present in Apache ActiveMQ Artemis 2.28.0. The vulnerability (OOM via maliciously crafted XID transaction ID fields with oversized buffer allocations) was fixed by upstream Apache in commit 72a4fff167 (ARTEMIS-3593) before the 2.28.0 release. TuxCare onboarded version 2.28.0 which already contained this upstream fix. The defense code (BufferHelper.safeReadBytes() with size ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-4040"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-4040 is NOT present in Apache ActiveMQ Artemis 2.28.0. The vulnerability (OOM via maliciously crafted XID transaction ID fields with oversized buffer allocations) was fixed by upstream Apache in commit 72a4fff167 (ARTEMIS-3593) before the 2.28.0 release. TuxCare onboarded version 2.28.0 which already contained this upstream fix. The defense code (BufferHelper.safeReadBytes() with size ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.broker/last-value-queue@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.broker/last-value-queue@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2022-23913 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.broker:last-value-queue.",
      "vulnerability": {
        "name": "CVE-2022-23913"
      },
      "action_statement": "Vulnerability CVE-2022-23913 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.broker:last-value-queue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.broker/last-value-queue@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.broker/last-value-queue@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:32:31.619248+00:00",
      "status_notes": "Vulnerability CVE-2026-49364 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.broker:last-value-queue.",
      "vulnerability": {
        "name": "CVE-2026-49364"
      },
      "action_statement": "Vulnerability CVE-2026-49364 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.broker:last-value-queue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.broker/last-value-queue@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.broker/last-value-queue@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:32:31.619248+00:00",
      "status_notes": "Vulnerability CVE-2026-57822 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.broker:last-value-queue.",
      "vulnerability": {
        "name": "CVE-2026-57822"
      },
      "action_statement": "Vulnerability CVE-2026-57822 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.broker:last-value-queue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.broker/last-value-queue@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.broker/last-value-queue@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:32:31.619248+00:00",
      "status_notes": "Vulnerability CVE-2026-75880 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.broker:last-value-queue.",
      "vulnerability": {
        "name": "CVE-2026-75880"
      },
      "action_statement": "Vulnerability CVE-2026-75880 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.broker:last-value-queue."
    }
  ]
}