Every CVE Search/ Get API key

CVE-2026-34197

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

8.8 HighIn KEVPublic exploitFix available

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

98.3%Up 98.2 points since Apr 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Record
CVE-2026-34197
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-94, CWE-78
Updated
2026-11-02
EUVDEUVD-2026-19588 8.8

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Record
EUVD-2026-19588
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-rxpj-7qvf-xv32 8.8

Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .

Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.

Record
GHSA-rxpj-7qvf-xv32
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
CISA KEV No score

Apache ActiveMQ Improper Input Validation Vulnerability

Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.

Record
CVE-2026-34197
Weakness
CWE-20, CWE-94
Updated
2026-11-02
NVD 8.8

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Record
CVE-2026-34197
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-94, CWE-78
Updated
2026-11-02
OSV 8.8

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Record
CVE-2026-34197
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-94
Updated
2026-11-02
Show 14 moreShow less
OSVDEBIAN-CVE-2026-34197 8.8

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Record
DEBIAN-CVE-2026-34197
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-rxpj-7qvf-xv32 8.8

Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .

Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.

Record
GHSA-rxpj-7qvf-xv32
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVOESA-2026-2124 8.8

activemq security update

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

'Severity: low \n\nAffected versions:\n\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.3\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.2\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.3\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.2\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.2\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.3\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.2\n\nDescription:\n\nImproper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ \nBroker, Apache ActiveMQ All.\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user \nprovided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the \napplication is exposed to a classpath path resource loading vulnerability that could potentially be chained together \nwith another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before \n6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 \nbefore 6.2.2.\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix \nthis issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and \n6.2.3.\n\nCredit:\n\nDawei Wang (finder)\n\nReferences:'

"Severity: important \n\nAffected versions:\n\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.4\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.3\n\nDescription:\n\nImproper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ \nBroker, Apache ActiveMQ.\n\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at\xa0/api/jolokia/ on the web console. The default Jolokia \naccess policy permits\xa0exec operations on all ActiveMQ\xa0MBeans (org.apache.activemq:*), including\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). \n\nAn authenticated attacker can\xa0invoke these operations with a crafted discovery URI that triggers the VM\xa0transport's \nbrokerConfig parameter to load a remote Spring XML application\xa0context using ResourceXmlApplicationContext. \nBecause Spring's\xa0ResourceXmlApplicationContext instantiates all singleton beans before the\xa0BrokerService validates the \nconfiguration, arbitrary code execution occurs\xa0on the broker's JVM through bean factory methods such as Runtime.exec().\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .\n\nUsers are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n\nCredit:\n\nNaveen Sunkavally (Horizon3.ai) (finder)\n\nReferences:"

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a…

Record
OESA-2026-2124
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2125 8.8

activemq security update

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

'Severity: low \n\nAffected versions:\n\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.3\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.2\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.3\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.2\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.2\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.3\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.2\n\nDescription:\n\nImproper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ \nBroker, Apache ActiveMQ All.\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user \nprovided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the \napplication is exposed to a classpath path resource loading vulnerability that could potentially be chained together \nwith another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before \n6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 \nbefore 6.2.2.\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix \nthis issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and \n6.2.3.\n\nCredit:\n\nDawei Wang (finder)\n\nReferences:'

"Severity: important \n\nAffected versions:\n\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.4\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.3\n\nDescription:\n\nImproper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ \nBroker, Apache ActiveMQ.\n\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at\xa0/api/jolokia/ on the web console. The default Jolokia \naccess policy permits\xa0exec operations on all ActiveMQ\xa0MBeans (org.apache.activemq:*), including\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). \n\nAn authenticated attacker can\xa0invoke these operations with a crafted discovery URI that triggers the VM\xa0transport's \nbrokerConfig parameter to load a remote Spring XML application\xa0context using ResourceXmlApplicationContext. \nBecause Spring's\xa0ResourceXmlApplicationContext instantiates all singleton beans before the\xa0BrokerService validates the \nconfiguration, arbitrary code execution occurs\xa0on the broker's JVM through bean factory methods such as Runtime.exec().\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .\n\nUsers are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n\nCredit:\n\nNaveen Sunkavally (Horizon3.ai) (finder)\n\nReferences:"

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a…

Record
OESA-2026-2125
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2126 8.8

activemq security update

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

'Severity: low \n\nAffected versions:\n\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.3\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.2\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.3\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.2\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.2\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.3\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.2\n\nDescription:\n\nImproper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ \nBroker, Apache ActiveMQ All.\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user \nprovided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the \napplication is exposed to a classpath path resource loading vulnerability that could potentially be chained together \nwith another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before \n6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 \nbefore 6.2.2.\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix \nthis issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and \n6.2.3.\n\nCredit:\n\nDawei Wang (finder)\n\nReferences:'

"Severity: important \n\nAffected versions:\n\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.4\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.3\n\nDescription:\n\nImproper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ \nBroker, Apache ActiveMQ.\n\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at\xa0/api/jolokia/ on the web console. The default Jolokia \naccess policy permits\xa0exec operations on all ActiveMQ\xa0MBeans (org.apache.activemq:*), including\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). \n\nAn authenticated attacker can\xa0invoke these operations with a crafted discovery URI that triggers the VM\xa0transport's \nbrokerConfig parameter to load a remote Spring XML application\xa0context using ResourceXmlApplicationContext. \nBecause Spring's\xa0ResourceXmlApplicationContext instantiates all singleton beans before the\xa0BrokerService validates the \nconfiguration, arbitrary code execution occurs\xa0on the broker's JVM through bean factory methods such as Runtime.exec().\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .\n\nUsers are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n\nCredit:\n\nNaveen Sunkavally (Horizon3.ai) (finder)\n\nReferences:"

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a…

Record
OESA-2026-2126
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2127 8.8

activemq security update

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

'Severity: low \n\nAffected versions:\n\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.3\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.2\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.3\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.2\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.2\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.3\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.2\n\nDescription:\n\nImproper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ \nBroker, Apache ActiveMQ All.\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user \nprovided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the \napplication is exposed to a classpath path resource loading vulnerability that could potentially be chained together \nwith another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before \n6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 \nbefore 6.2.2.\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix \nthis issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and \n6.2.3.\n\nCredit:\n\nDawei Wang (finder)\n\nReferences:'

"Severity: important \n\nAffected versions:\n\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.4\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.3\n\nDescription:\n\nImproper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ \nBroker, Apache ActiveMQ.\n\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at\xa0/api/jolokia/ on the web console. The default Jolokia \naccess policy permits\xa0exec operations on all ActiveMQ\xa0MBeans (org.apache.activemq:*), including\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). \n\nAn authenticated attacker can\xa0invoke these operations with a crafted discovery URI that triggers the VM\xa0transport's \nbrokerConfig parameter to load a remote Spring XML application\xa0context using ResourceXmlApplicationContext. \nBecause Spring's\xa0ResourceXmlApplicationContext instantiates all singleton beans before the\xa0BrokerService validates the \nconfiguration, arbitrary code execution occurs\xa0on the broker's JVM through bean factory methods such as Runtime.exec().\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .\n\nUsers are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n\nCredit:\n\nNaveen Sunkavally (Horizon3.ai) (finder)\n\nReferences:"

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a…

Record
OESA-2026-2127
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34197 8.8

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Record
UBUNTU-CVE-2026-34197
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-activemq-2026-34197 No score

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Record
BIT-activemq-2026-34197
Updated
2026-11-02
OSVCLSA-2026-1790690736 No score

TuxCare security update for org.apache.activemq (1 CVE)

TuxCare rebuilt 2 org.apache.activemq packages to address 1 CVE. Fixed in 6.1.8-tuxcare.2.

Record
CLSA-2026-1790690736
Updated
2026-11-02
OSVCLSA-2026-1791293470 No score

TuxCare security update for org.apache.activemq (2 CVEs)

TuxCare rebuilt 3 org.apache.activemq packages to address 2 CVEs. Fixed in 6.1.6-tuxcare.1.

Record
CLSA-2026-1791293470
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-34197 No score

CVE-2026-34197 in org.apache.activemq:activemq-broker - Patched by Root

Root has patched CVE-2026-34197 in the org.apache.activemq:activemq-broker package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2026-34197
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-34197 No score

CVE-2026-34197 in activemq - Patched by Root

Root has patched CVE-2026-34197 in the activemq package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-34197
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-34197 No score

CVE-2026-34197 in activemq - Patched by Root

Root has patched CVE-2026-34197 in the activemq package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-34197
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-34197 No score

CVE-2026-34197 in activemq - Patched by Root

Root has patched CVE-2026-34197 in the activemq package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-34197
Updated
2026-11-02

Affected products

Show 1 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
org.apache.activemq:activemq-broker
Maven
 before 5.19.5
5.19.5
org.apache.activemq:activemq-broker
Maven
 6.0.0 up to 6.2.3
6.2.3
org.apache.activemq:activemq-all
Maven
 before 5.19.5
5.19.5
org.apache.activemq:activemq-all
Maven
 6.0.0 up to 6.2.3
6.2.3
activemq
Bitnami
 before 5.19.4, 6.0.0 up to 6.2.3
5.19.46.2.3
org.apache.activemq:activemq-all
TuxCare:Maven
 6.1.8 up to 6.1.8-tuxcare.2, plus listed versions
6.1.8-tuxcare.1
6.1.8-tuxcare.2
org.apache.activemq:activemq-broker
TuxCare:Maven
 6.1.8 up to 6.1.8-tuxcare.2, plus listed versions
6.1.8-tuxcare.1
6.1.8-tuxcare.2
org.apache.activemq:activemq-all
TuxCare:Maven
 6.1.6 up to 6.1.6-tuxcare.1
6.1.6-tuxcare.1
org.apache.activemq:activemq-broker
TuxCare:Maven
 6.1.6 up to 6.1.6-tuxcare.1
6.1.6-tuxcare.1
org.apache.activemq:apache-activemq
TuxCare:Maven
 6.1.6 up to 6.1.6-tuxcare.1
6.1.6-tuxcare.1
Show 28 moreShow less
Affected packages
PackageAffectedFixed
activemq
Debian:12
 All versions, plus listed versions
5.17.2+dfsg-25.17.2+dfsg-2+deb12u15.17.6+dfsg-15.17.6+dfsg-2
 None known
activemq
Debian:13
 All versions, plus listed versions
5.17.6+dfsg-2
 None known
org.apache.activemq:activemq-broker
Maven
 before 5.19.5, plus listed versions
5.10.05.10.15.10.25.11.05.11.1
Show 45 moreShow less
5.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.14.05.14.15.14.25.14.35.14.45.14.55.15.05.15.15.15.105.15.115.15.125.15.135.15.145.15.155.15.165.15.25.15.35.15.45.15.55.15.65.15.75.15.85.15.95.16.05.16.15.16.25.16.35.16.45.16.55.16.65.16.75.16.8
5.19.5
org.apache.activemq:activemq-broker
Maven
 6.0.0 up to 6.2.3, plus listed versions
6.0.16.1.06.1.16.1.26.1.3
Show 8 moreShow less
6.1.46.1.56.1.66.1.76.1.86.2.06.2.16.2.2
6.2.3
org.apache.activemq:activemq-all
Maven
 before 5.19.5, plus listed versions
4.1.25.0.05.1.05.10.05.10.1
Show 45 moreShow less
5.10.25.11.05.11.15.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.14.05.14.15.14.25.14.35.14.45.14.55.15.05.15.15.15.105.15.115.15.125.15.135.15.145.15.155.15.165.15.25.15.35.15.45.15.55.15.65.15.75.15.85.15.95.16.05.16.15.16.25.16.35.16.45.16.5
5.19.5
org.apache.activemq:activemq-all
Maven
 6.0.0 up to 6.2.3, plus listed versions
6.0.16.1.06.1.16.1.26.1.3
Show 8 moreShow less
6.1.46.1.56.1.66.1.76.1.86.2.06.2.16.2.2
6.2.3
activemq
openEuler:22.03-LTS-SP4
 before 5.19.6-1.oe2203sp4
5.19.6-1.oe2203sp4
activemq
openEuler:24.03-LTS
 before 5.19.6-1.oe2403
5.19.6-1.oe2403
activemq
openEuler:24.03-LTS-SP1
 before 5.19.6-1.oe2403sp1
5.19.6-1.oe2403sp1
activemq
openEuler:24.03-LTS-SP3
 before 5.19.6-1.oe2403sp3
5.19.6-1.oe2403sp3
org.apache.activemq:activemq-broker
Root:Maven
 before 5.17.3-aikido.2
5.17.3-aikido.25.18.3-aikido.106.1.6-aikido.26.2.0-aikido.25.17.1-aikido.26.0.1-aikido.26.1.3-aikido.55.18.3-aikido.116.1.3-aikido.66.1.3-aikido.75.18.3-aikido.126.1.3-aikido.86.1.8-aikido.16.1.8-aikido.26.1.8-aikido.36.1.8-aikido.4
org.apache.activemq:activemq-all
Root:Maven
 before 6.1.3-aikido.5
6.1.3-aikido.56.1.3-aikido.66.1.3-aikido.76.1.3-aikido.86.1.8-aikido.26.1.8-aikido.36.1.8-aikido.4
io.root.org.apache.activemq:activemq-broker
Root:Maven
 before 6.1.6-root.io.1
6.1.6-root.io.15.17.3-root.io.15.17.1-root.io.16.0.1-root.io.16.2.0-root.io.15.18.3-root.io.75.18.3-root.io.86.1.3-root.io.45.18.3-root.io.95.17.3-root.io.25.18.3-root.io.106.1.6-root.io.26.2.0-root.io.25.17.1-root.io.26.0.1-root.io.26.1.3-root.io.55.18.3-root.io.116.1.3-root.io.66.1.3-root.io.75.18.3-root.io.126.1.3-root.io.86.1.8-root.io.16.1.8-root.io.26.1.8-root.io.36.1.8-root.io.4
io.root.org.apache.activemq:activemq-all
Root:Maven
 before 6.1.3-root.io.3
6.1.3-root.io.36.1.3-root.io.46.1.3-root.io.56.1.3-root.io.66.1.3-root.io.76.1.3-root.io.86.1.8-root.io.26.1.8-root.io.36.1.8-root.io.4
activemq
Root:Debian:11
 before 5.16.1-1+deb11u2.aikido.2
5.16.1-1+deb11u2.aikido.25.16.1-1+deb11u2.root.io.1
rootio-activemq
Root:Debian:11
 before 5.16.1-1+deb11u2.aikido.2
5.16.1-1+deb11u2.aikido.25.16.1-1+deb11u2.root.io.1
activemq
Root:Debian:12
 before 5.17.2+dfsg-2+deb12u1.root.io.1
5.17.2+dfsg-2+deb12u1.root.io.15.17.2+dfsg-2+deb12u1.aikido.2
rootio-activemq
Root:Debian:12
 before 5.17.2+dfsg-2+deb12u1.root.io.1
5.17.2+dfsg-2+deb12u1.root.io.15.17.2+dfsg-2+deb12u1.aikido.2
activemq
Root:Debian:13
 before 5.17.6+dfsg-2.aikido.2
5.17.6+dfsg-2.aikido.25.17.6+dfsg-2.root.io.1
rootio-activemq
Root:Debian:13
 before 5.17.6+dfsg-2.aikido.2
5.17.6+dfsg-2.aikido.25.17.6+dfsg-2.root.io.1
activemq
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-25.13.2+dfsg-2ubuntu0.1~esm1
 None known
activemq
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.14.5-35.15.2-25.15.3-25.15.8-2~18.045.15.8-2~18.04.1~esm1
 None known
activemq
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.15.10-15.15.11-15.15.11-1ubuntu0.1~esm1
 None known
activemq
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.16.1-15.16.1-1ubuntu0.1~esm15.16.1-1ubuntu0.1
 None known
activemq
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.17.2+dfsg-25.17.6+dfsg-1
 None known
activemq
Ubuntu:25.10
 All versions, plus listed versions
5.17.6+dfsg-15.17.6+dfsg-2
 None known
activemq
Ubuntu:26.10
 All versions, plus listed versions
5.17.6+dfsg-25.17.6+dfsg-2ubuntu1
 None known
activemq
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.17.6+dfsg-2
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHub0xBlackash/CVE-2026-341972026-04-08
PoC in GitHubDEVSECURITYSPRO/CVE-2026-341972026-04-08
PoC in GitHubdinosn/CVE-2026-341972026-04-08
PoC in GitHubAtoposX-J/CVE-2026-34197-Apache-ActiveMQ-RCE2026-04-09
PoC in GitHubKONDORDEVSECURITYCORP/CVE-2026-341972026-04-09
PoC in GitHubkeraattin/CVE-2026-341972026-04-14
PoC in GitHubCatherines77/ActiveMQ-EXPtools2026-04-20
PoC in GitHubxshysjhq/CVE-2026-34197-payload-Apache-ActiveMQ-2026-04-20
MetasploitApache ActiveMQ RCE via Jolokia addNetworkConnector2026-04-29
PoC in GitHubrootdirective-sec/CVE-2026-34197-Lab2026-05-08
Show 6 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubLAT-06/CVE-2026-341972026-05-18
PoC in GitHubasdasddqwdq29-a11y/CVE-2026-341972026-06-06
PoC in GitHubdinosn/apache-activemq-rce-research2026-07-04
PoC in GitHubpssec-io/CVE-2026-341972026-07-08
PoC in GitHubnirvanasec/CVE-2026-34197-PoC2026-09-04
NucleiApache ActiveMQ - Remote Code Execution

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34197 is a high vulnerability (CVSS 8.8) in Apache Activemq, published April 7, 2026. CISA lists it as known to be exploited, since April 16, 2026. EUVD reports exploitation since April 16, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.3%, the 99th percentile. Fixed in org.apache.activemq:activemq-broker 5.19.5.

References

Show 19 moreShow less
This page doesn't list everything

Left out here: 63 versions and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open