{"id":"CVE-2025-27427","aliases":["CLSA-2026-1776126824","CLSA-2026-1780966327","CLSA-2026-1786943805","CLSA-2026-1789384355","EUVD-2025-9321","GHSA-3w85-5p9g-h334","ROOT-APP-MAVEN-CVE-2025-27427"],"status":"published","title":"Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission","description":"A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.\n\nThis issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.\n\nUsers are recommended to upgrade to version 2.40.0 which fixes the issue.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00653,"percentile":0.51796,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2025-04-01T07:26:59Z","modified":"2026-11-02T19:46:16Z","fixes":[{"ecosystem":"Maven","package":"org.apache.activemq:artemis-server","fixed_in":["2.40.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.activemq:artemis-server","fixed_in":["2.26.0-tuxcare.2","2.37.0-tuxcare.1","2.28.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.activemq:artemis-server","fixed_in":["2.31.2-aikido.4","2.33.0-aikido.5","2.40.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.activemq:artemis-server","fixed_in":["2.33.0-root.io.2","2.33.0-root.io.3","2.33.0-root.io.4","2.31.2-root.io.3","2.31.2-root.io.4","2.33.0-root.io.5","2.40.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.40.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.activemq:artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.33.0"},{"fixed":"2.33.0-tuxcare.1"}]}],"versions":["2.33.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.activemq:artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.26.0"},{"fixed":"2.26.0-tuxcare.2"}]}],"versions":["2.26.0","2.26.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.activemq:artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"fixed":"2.37.0-tuxcare.1"}]}],"versions":["2.37.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.activemq:artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.28.0"},{"fixed":"2.28.0-tuxcare.1"}]}],"versions":["2.28.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.40.0"}]}],"versions":["2.0.0","2.1.0","2.10.0","2.10.1","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.19.1","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.23.1","2.24.0","2.25.0","2.26.0","2.27.0","2.27.1","2.28.0","2.29.0","2.3.0","2.30.0","2.31.0","2.31.1","2.31.2","2.32.0","2.33.0","2.34.0","2.35.0","2.36.0","2.37.0","2.38.0","2.39.0","2.4.0","2.5.0","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.7.0","2.8.0","2.8.1","2.9.0"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.activemq:artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.2-aikido.4"},{"fixed":"2.33.0-aikido.5"},{"fixed":"2.40.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.activemq:artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.0-root.io.2"},{"fixed":"2.33.0-root.io.3"},{"fixed":"2.33.0-root.io.4"},{"fixed":"2.31.2-root.io.3"},{"fixed":"2.31.2-root.io.4"},{"fixed":"2.33.0-root.io.5"},{"fixed":"2.40.0-root.io.1"}]}]}],"products":[{"vendor":"apache","product":"artemis"},{"vendor":"apache software foundation","product":"apache activemq artemis"}],"references":[{"url":"https://lists.apache.org/thread/8dzlm2vkqphyrnkrby8r8kzndsm5o6x8","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/31/1","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27427","tags":["advisory"]},{"url":"https://github.com/apache/activemq-artemis/commit/2216a75a57f098295abb283d556c8b8bda91324d","tags":["web"]},{"url":"https://github.com/apache/activemq-artemis/commit/6ab458015689303db8878941abe1bc973299fc2e","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/ARTEMIS-5346","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3w85-5p9g-h334"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27427.json","tags":["advisory"]},{"url":"https://github.com/apache/activemq-artemis","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-27427","title":"Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission","description":"A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.\n\nThis issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.\n\nUsers are recommended to upgrade to version 2.40.0 which fixes the issue.","status":"published","published":"2025-04-01T07:26:59.994Z","modified":"2025-04-02T22:03:20.21Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:32:42.411662Z"}],"euvd":[{"id":"EUVD-2025-9321","description":"A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.\n\nThis issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.\n\nUsers are recommended to upgrade to version 2.40.0 which fixes the issue.","status":"published","published":"2025-04-01T07:26:59Z","modified":"2025-04-02T22:03:20Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T20:52:44.372321Z"}],"ghsa":[{"id":"GHSA-3w85-5p9g-h334","title":"Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type","description":"A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.\n\nThis issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.\n\nUsers are recommended to upgrade to version 2.40.0 which fixes the issue.","status":"published","published":"2025-04-01T09:30:19Z","modified":"2025-07-15T00:27:01Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:49.837727Z"}],"nvd":[{"id":"CVE-2025-27427","description":"A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.\n\nThis issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.\n\nUsers are recommended to upgrade to version 2.40.0 which fixes the issue.","status":"published","published":"2025-04-01T08:15:13.86Z","modified":"2026-06-17T09:03:34.233Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:10:57.134561Z"}],"osv":[{"id":"CVE-2025-27427","title":"Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission","description":"A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.\n\nThis issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.\n\nUsers are recommended to upgrade to version 2.40.0 which fixes the issue.","status":"published","published":"2025-04-01T07:26:59.994Z","modified":"2026-10-28T02:30:53.195259775Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-3w85-5p9g-h334","title":"Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type","description":"A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.\n\nThis issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.\n\nUsers are recommended to upgrade to version 2.40.0 which fixes the issue.","status":"published","published":"2025-04-01T09:30:19Z","modified":"2026-09-10T03:50:57.081347921Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"CLSA-2026-1776126824","title":"TuxCare security update for org.apache.activemq:artemis-server (2 CVEs)","description":"TuxCare rebuilt org.apache.activemq:artemis-server to address 2 CVEs. Fixed in 2.33.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:25Z","modified":"2026-11-02T19:45:22.464614171Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1780966327","title":"TuxCare security update for org.apache.activemq:artemis-server (1 CVE)","description":"TuxCare rebuilt org.apache.activemq:artemis-server to address 1 CVE. Fixed in 2.26.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-11-02T19:45:37.855267508Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1786943805","title":"TuxCare security update for org.apache.activemq:artemis-server (1 CVE)","description":"TuxCare rebuilt org.apache.activemq:artemis-server to address 1 CVE. Fixed in 2.37.0-tuxcare.1.","status":"published","published":"2026-08-17T05:16:45Z","modified":"2026-11-02T19:45:52.241207586Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1789384355","title":"TuxCare security update for org.apache.activemq:artemis-server (1 CVE)","description":"TuxCare rebuilt org.apache.activemq:artemis-server to address 1 CVE. Fixed in 2.28.0-tuxcare.1.","status":"published","published":"2026-09-14T11:12:35Z","modified":"2026-11-02T19:46:16.415395819Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-27427","title":"CVE-2025-27427 in org.apache.activemq:artemis-server - Patched by Root","description":"Root has patched CVE-2025-27427 in the org.apache.activemq:artemis-server package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-27T15:41:06Z","modified":"2026-08-27T17:15:05.643920094Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}