{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5b952297-8100-545b-88a0-22b08da67345",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "amqp-client",
      "purl": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1",
      "type": "library",
      "group": "com.rabbitmq",
      "bom-ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1",
      "version": "5.22.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "amqp-client",
            "purl": "pkg:maven/com.rabbitmq/amqp-client@5.22.0",
            "type": "library",
            "group": "com.rabbitmq",
            "version": "5.22.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-106121",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:665252f5-df59-5a53-96d2-3871432d1ead",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106121 affects version 5.22.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-106122",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:65f22e28-8d97-5129-bb72-0cc858115451",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106122 affects version 5.22.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-106123",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1bd64b8f-1aa8-57d7-aa8f-f05e9b9e320f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106123 affects version 5.22.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-61634",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:44b90d81-af88-576d-9322-ebb2c2b84a4c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-61634 affects version 5.22.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63335",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:56f82d46-a57d-533f-9c34-5922146ba7d4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-63335 affects version 5.22.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63336",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d9f2270f-1894-579c-a621-e01a2af13185",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-63336 affects version 5.22.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-63337",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f30bac63-5d5d-5cf4-9c13-21e46e7d89fe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-63337 affects version 5.22.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-69219",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ac5f37f4-947d-5e5e-b67d-ab704a48f9cb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69219 is fixed in version 5.22.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-69220",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9d54c10e-9fa3-5896-bdaa-0c417cc92d93",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69220 affects version 5.22.0-tuxcare.1 of com.rabbitmq:amqp-client."
      }
    },
    {
      "id": "CVE-2026-75516",
      "affects": [
        {
          "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ffc31462-e39a-50ae-bac4-094ce81454ec",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-75516 does not affect version 5.22.0-tuxcare.1 of com.rabbitmq:amqp-client. not_affected \u2014 Version 5.22.0 does not contain the vulnerable code pattern described in CVE-2026-75516. The CVE describes a vulnerability where Math.min(maxInboundMessageBodySize, frameMax) with frameMax=0 defeats the 64MB inbound size cap, allowing unbounded allocations. This version lacks that code path entirely: inbound frame size limits are fixed at maxInboundMessageBodySize (64MB default) and are never a...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.rabbitmq/amqp-client@5.22.0-tuxcare.1"
    }
  ]
}