Dependency tracker marks activemq-broker as vulnerable

I use spring-boot-starter-activemq with the lastest version of springboot (2.7.1). Our company's dependency tracker marks activemq-broker which is part of the starter as vulnerable because of CVE-2015-3208 (XML external entity - XXE). We use ActiveMQ instead of Artemis for integration with some legacy system. Is there a way to fix it or is this just a false positive ? I see that that there are updates in maven repository quite frequently (link) hence I can't believe that the vulnerability published in 2017 is not solved yet.
Thank you for your thoughts !