{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:82a23d66-d46d-5de9-975c-557786d8d521",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "amqp-client",
      "purl": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1",
      "type": "library",
      "group": "com.rabbitmq",
      "bom-ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1",
      "version": "5.16.1-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "amqp-client",
            "purl": "pkg:maven/com.rabbitmq/amqp-client@5.16.1",
            "type": "library",
            "group": "com.rabbitmq",
            "version": "5.16.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-46120",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2eaddf33-4a42-5366-b6c6-85058991e65d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-46120 affects version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-106121",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e388d182-f0f7-59b0-a341-409123443414",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106121 affects version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-106122",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0086835e-3cce-52f8-bc1e-c17e6790fc8f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106122 affects version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-106123",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:39e30ea3-6ed9-5e34-95e2-dd48b86bf62b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106123 affects version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-61634",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b4f774b2-40f8-521f-8d54-d132775f365f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-61634 affects version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63335",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f0cdd632-0fb9-5818-9fcc-8a8e1cb9bc25",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-63335 is fixed in version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63336",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c33b09d8-39c4-5956-8928-c8ce77f583eb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-63336 is fixed in version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63337",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9610c6da-96eb-55fb-8d5e-641b96efa88d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-63337 is fixed in version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-69219",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bb95dfb3-5680-5dc6-98db-9987e6023b05",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69219 is fixed in version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-69220",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9dda8b0a-3bd6-5ae1-b07d-1fabf2780748",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69220 affects version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-75516",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:71aae111-f8b1-5b4a-ac38-051df6a7df7b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-75516 does not affect version 5.16.1-tuxcare.1 of com.rabbitmq:amqp-client. not_affected \u2014 Version 5.16.1 does not contain the vulnerable code pattern described in CVE-2026-75516. The CVE targets later versions (5.30.0+) where a `_frameHandler.setFrameMax(Math.min(maxInboundMessageBodySize, frameMax))` call dynamically adjusts the inbound frame size limit based on server-negotiated frameMax, allowing a malicious server to bypass the 64MB protection by sending frameMax=0. In version 5...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.rabbitmq/amqp-client@5.16.1-tuxcare.1"
    }
  ]
}