{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1c2fa14e-bb53-56c8-a626-46e231fff755", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1", "type": "library", "group": "com.rabbitmq", "bom-ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1", "version": "4.0.3-tuxcare.1", "pedigree": { "ancestors": [ { "name": "amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client@4.0.3", "type": "library", "group": "com.rabbitmq", "version": "4.0.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11087", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:b6a79dc3-ef03-5ef2-a5ee-92e49a6853c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11087 affects version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2023-46120", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a2427d50-a339-53a6-a597-3491303694e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46120 affects version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106121", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9e491e3d-97ca-5fbc-b6ea-6e33f2953b0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106121 affects version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106122", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:689f7bfe-674f-5db4-a1e1-7b36c64cdda3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106122 affects version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-106123", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:fb174e61-3dc5-56e2-8759-bfba6628d2b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-106123 affects version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-61634", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:04f7fc32-9e68-5bb6-ba00-e09a9a474220", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-61634 affects version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63335", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:405ab116-67f3-545e-9f08-5a7590f3ae8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-63335 is fixed in version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63336", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:70615159-aedf-5af3-a3e7-305d995b4654", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-63336 affects version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-63337", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e993e023-eba6-502a-879a-de6e1a8a38e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-63337 does not affect version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client. Version 4.0.3 does not contain the vulnerable code pattern described in CVE-2026-63337. The vulnerability requires a javaReturnType field in service descriptions that gets passed to Class.forName() with initialize=true, enabling arbitrary static initializer execution. That field, together with ProcedureDescription.computeReturnTypeAsJavaClass(), was introduced upstream in commit e28b34ad8094b47a7fa46112490d1308bf8418b9 (Adding Jackson support in JSON RPC) on 13 August 2018, over a year after version 4.0.3 was released on 7 June 2017. Version 4.0.3 uses a simpler service description protocol with only generic JSON-RPC types and has zero Class.forName calls in the JSON-RPC codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-69219", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1b004db9-eb1e-550b-955d-bd478d3af001", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69219 affects version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-69220", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:eba6a8d0-03e3-52c8-a5c5-ea65e1e382ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69220 is fixed in version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client." } }, { "id": "CVE-2026-75516", "affects": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ], "bom-ref": "urn:uuid:5071396f-01fe-5496-be26-6fb784845765", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-75516 does not affect version 4.0.3-tuxcare.1 of com.rabbitmq:amqp-client. not_affected \u2014 Version 4.0.3 (released June 2017) is NOT affected by CVE-2026-75516. The vulnerability describes a specific bug where `Math.min(maxInboundMessageBodySize, frameMax)` with `frameMax=0` defeats the `maxInboundMessageBodySize` protection mechanism. However, version 4.0.3 predates the introduction of the `maxInboundMessageBodySize` feature by 6 years (added June 2023 in commit 714aae60). The vulne...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/com.rabbitmq/amqp-client@4.0.3-tuxcare.1" } ] }