CVE-2025-27427
Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission
A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.
This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.
Users are recommended to upgrade to version 2.40.0 which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission
A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.
This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.
Users are recommended to upgrade to version 2.40.0 which fixes the issue.
- Record
CVE-2025-27427- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2025-9321
A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.
This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.
Users are recommended to upgrade to version 2.40.0 which fixes the issue.
- Record
EUVD-2025-9321- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3w85-5p9g-h334
Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type
A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.
This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.
Users are recommended to upgrade to version 2.40.0 which fixes the issue.
- Record
GHSA-3w85-5p9g-h334- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.
This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.
Users are recommended to upgrade to version 2.40.0 which fixes the issue.
- Record
CVE-2025-27427- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission
A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.
This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.
Users are recommended to upgrade to version 2.40.0 which fixes the issue.
- Record
CVE-2025-27427- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-3w85-5p9g-h334
Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type
A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.
This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.
Users are recommended to upgrade to version 2.40.0 which fixes the issue.
- Record
GHSA-3w85-5p9g-h334- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1776126824 No score
TuxCare security update for org.apache.activemq:artemis-server (2 CVEs)
TuxCare rebuilt org.apache.activemq:artemis-server to address 2 CVEs. Fixed in 2.33.0-tuxcare.1.
- Record
CLSA-2026-1776126824- Updated
- 2026-11-02
OSVCLSA-2026-1780966327 No score
TuxCare security update for org.apache.activemq:artemis-server (1 CVE)
TuxCare rebuilt org.apache.activemq:artemis-server to address 1 CVE. Fixed in 2.26.0-tuxcare.2.
- Record
CLSA-2026-1780966327- Updated
- 2026-11-02
OSVCLSA-2026-1786943805 No score
TuxCare security update for org.apache.activemq:artemis-server (1 CVE)
TuxCare rebuilt org.apache.activemq:artemis-server to address 1 CVE. Fixed in 2.37.0-tuxcare.1.
- Record
CLSA-2026-1786943805- Updated
- 2026-11-02
OSVCLSA-2026-1789384355 No score
TuxCare security update for org.apache.activemq:artemis-server (1 CVE)
TuxCare rebuilt org.apache.activemq:artemis-server to address 1 CVE. Fixed in 2.28.0-tuxcare.1.
- Record
CLSA-2026-1789384355- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-27427 No score
CVE-2025-27427 in org.apache.activemq:artemis-server - Patched by Root
Root has patched CVE-2025-27427 in the org.apache.activemq:artemis-server package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-27427- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.activemq:artemis-serverMaven |
2.0.0 up to 2.40.0 | 2.40.0 |
org.apache.activemq:artemis-serverTuxCare:Maven |
2.33.0 up to 2.33.0-tuxcare.1 | 2.33.0-tuxcare.1 |
org.apache.activemq:artemis-serverTuxCare:Maven |
2.26.0 up to 2.26.0-tuxcare.2, plus listed versions 2.26.0-tuxcare.1 |
2.26.0-tuxcare.2 |
org.apache.activemq:artemis-serverTuxCare:Maven |
2.37.0 up to 2.37.0-tuxcare.1 | 2.37.0-tuxcare.1 |
org.apache.activemq:artemis-serverTuxCare:Maven |
2.28.0 up to 2.28.0-tuxcare.1 | 2.28.0-tuxcare.1 |
org.apache.activemq:artemis-serverMaven |
2.0.0 up to 2.40.0, plus listed versions 2.1.02.10.02.10.12.11.02.12.0 Show 45 moreShow less2.13.02.14.02.15.02.16.02.17.02.18.02.19.02.19.12.2.02.20.02.21.02.22.02.23.02.23.12.24.02.25.02.26.02.27.02.27.12.28.02.29.02.3.02.30.02.31.02.31.12.31.22.32.02.33.02.34.02.35.02.36.02.37.02.38.02.39.02.4.02.5.02.6.02.6.12.6.22.6.32.6.42.7.02.8.02.8.12.9.0 |
2.40.0 |
org.apache.activemq:artemis-serverRoot:Maven |
before 2.31.2-aikido.4 | 2.31.2-aikido.42.33.0-aikido.52.40.0-aikido.1 |
io.root.org.apache.activemq:artemis-serverRoot:Maven |
before 2.33.0-root.io.2 | 2.33.0-root.io.22.33.0-root.io.32.33.0-root.io.42.31.2-root.io.32.31.2-root.io.42.33.0-root.io.52.40.0-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-27427 is a low vulnerability (CVSS 2.3) in Apache Artemis, published April 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in org.apache.activemq:artemis-server 2.40.0.
References
lists.apache.org/thread/8dzlm2vkqphyrnkrby8r8kzndsm5o6x8
openwall.com/lists/oss-security/2025/03/31/1
nvd.nist.gov/vuln/detail/CVE-2025-27427
github.com/apache/activemq-artemis/commit/2216a75a57f098295abb283d556c8b8bda91324d
issues.apache.org/jira/browse/ARTEMIS-5346