{
  "@id": "urn:uuid:7ac51ba9-d067-48ff-965b-c8aa05193d22",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T22:31:00.191049+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:17:49.776988+00:00",
      "status_notes": "Vulnerability CVE-2020-10727 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor.",
      "vulnerability": {
        "name": "CVE-2020-10727"
      },
      "action_statement": "Vulnerability CVE-2020-10727 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T22:31:00.191049+00:00",
      "status_notes": "Vulnerability CVE-2021-4040 does not affect version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor. not_affected \u2014 CVE-2021-4040 is NOT present in Apache ActiveMQ Artemis 2.28.0. The vulnerability (OOM via maliciously crafted XID transaction ID fields with oversized buffer allocations) was fixed by upstream Apache in commit 72a4fff167 (ARTEMIS-3593) before the 2.28.0 release. TuxCare onboarded version 2.28.0 which already contained this upstream fix. The defense code (BufferHelper.safeReadBytes() with size ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-4040"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-4040 is NOT present in Apache ActiveMQ Artemis 2.28.0. The vulnerability (OOM via maliciously crafted XID transaction ID fields with oversized buffer allocations) was fixed by upstream Apache in commit 72a4fff167 (ARTEMIS-3593) before the 2.28.0 release. TuxCare onboarded version 2.28.0 which already contained this upstream fix. The defense code (BufferHelper.safeReadBytes() with size ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2022-23913 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor.",
      "vulnerability": {
        "name": "CVE-2022-23913"
      },
      "action_statement": "Vulnerability CVE-2022-23913 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T20:00:10.269003+00:00",
      "status_notes": "Vulnerability CVE-2022-35278 does not affect version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor. not_affected \u2014 CVE-2022-35278 affects Apache ActiveMQ Artemis versions prior to 2.24.0, where XSS was possible via HTML in queue/address names. The target (version 2.28.0) is not affected because the upstream fix was already present in the release that TuxCare onboarded. All vulnerable `templateFn` string concatenation patterns have been replaced with Angular's `htmlTemplate` binding system (using `{{value}}`...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-35278"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-35278 affects Apache ActiveMQ Artemis versions prior to 2.24.0, where XSS was possible via HTML in queue/address names. The target (version 2.28.0) is not affected because the upstream fix was already present in the release that TuxCare onboarded. All vulnerable `templateFn` string concatenation patterns have been replaced with Angular's `htmlTemplate` binding system (using `{{value}}`..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-27427 is fixed in version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor.",
      "vulnerability": {
        "name": "CVE-2025-27427"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-27446 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor.",
      "vulnerability": {
        "name": "CVE-2026-27446"
      },
      "action_statement": "Vulnerability CVE-2026-27446 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:32:31.619248+00:00",
      "status_notes": "Vulnerability CVE-2026-49362 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor.",
      "vulnerability": {
        "name": "CVE-2026-49362"
      },
      "action_statement": "Vulnerability CVE-2026-49362 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:35:35.108755+00:00",
      "status_notes": "Vulnerability CVE-2026-49363 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor.",
      "vulnerability": {
        "name": "CVE-2026-49363"
      },
      "action_statement": "Vulnerability CVE-2026-49363 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:32:31.619248+00:00",
      "status_notes": "Vulnerability CVE-2026-49364 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor.",
      "vulnerability": {
        "name": "CVE-2026-49364"
      },
      "action_statement": "Vulnerability CVE-2026-49364 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:32:31.619248+00:00",
      "status_notes": "Vulnerability CVE-2026-57822 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor.",
      "vulnerability": {
        "name": "CVE-2026-57822"
      },
      "action_statement": "Vulnerability CVE-2026-57822 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:32:31.619248+00:00",
      "status_notes": "Vulnerability CVE-2026-57967 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor.",
      "vulnerability": {
        "name": "CVE-2026-57967"
      },
      "action_statement": "Vulnerability CVE-2026-57967 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq.examples.stomp/stomp-embedded-interceptor@2.28.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:32:31.619248+00:00",
      "status_notes": "Vulnerability CVE-2026-75880 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor.",
      "vulnerability": {
        "name": "CVE-2026-75880"
      },
      "action_statement": "Vulnerability CVE-2026-75880 affects version 2.28.0-tuxcare.1 of org.apache.activemq.examples.stomp:stomp-embedded-interceptor."
    }
  ]
}