{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:46a1a533-f678-5e45-a5b5-394d7c382045",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "amqp-client",
      "purl": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1",
      "type": "library",
      "group": "com.rabbitmq",
      "bom-ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1",
      "version": "5.20.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "amqp-client",
            "purl": "pkg:maven/com.rabbitmq/amqp-client@5.20.0",
            "type": "library",
            "group": "com.rabbitmq",
            "version": "5.20.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-106121",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e837c43a-3a88-5e4c-a27c-76acbba0b8f4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106121 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-106122",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f0640506-ca42-58fe-802d-612e5320a279",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106122 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-106123",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e3a0bbec-e838-5a77-8269-590d30e194f6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106123 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-61634",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ccb53d36-a28b-5b58-ad04-16cf5d87aa87",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-61634 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63335",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:96e70c95-6548-5702-944e-a6122bc45a09",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-63335 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63336",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d501518f-381f-5cdc-9c4f-826d8b9e49b3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-63336 is fixed in version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63337",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a47f6c24-5611-5c27-a8fc-4e63c04d37ec",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-63337 is fixed in version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-69219",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fed58163-50d5-5461-a5a3-0ddde7acfa18",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69219 is fixed in version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-69220",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:894b70f2-c5b9-5c5e-80b1-b13cd773329a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69220 affects version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-75516",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:91e030eb-e12d-533d-b058-fd8fac47929e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-75516 does not affect version 5.20.0-tuxcare.1 of com.rabbitmq:amqp-client. Target version 5.20.0 is NOT AFFECTED. The upstream vendor (RabbitMQ/VMware) already fixed this OOM vulnerability in commit 714aae60 (June 2023), which added a maxPayloadSize check to Frame.readFrom() before byte array allocation. This fix is included in version 5.20.0 (released October 2023). The CVE describes vulnerable code patterns (setFrameMax with Math.min, Utils.framePayloadLimit) that do not exist in this version. The defense at Frame.java:112-118 checks if payloadSize >= maxPayloadSize and throws IllegalStateException BEFORE allocating the byte array, preventing unbounded allocation regardless of the negotiated frameMax value. Default limit is 64MB (maxInboundMessageBodySize).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.rabbitmq/amqp-client@5.20.0-tuxcare.1"
    }
  ]
}