activemq vulnerabilities (Bitnami)

47 vulnerabilities.

• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId CVE-2026-74761 Fix available 7.5 HighSeptember 9, 2026
• activemq Bitnami Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS CVE-2026-59878 Fix available 7.5 HighJuly 28, 2026
• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations CVE-2026-61487 Fix available 6.5 MediumJuly 28, 2026
• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker CVE-2026-49434 Fix available 7.5 HighJune 30, 2026
• activemq Bitnami Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service CVE-2026-49432 Fix available 7.5 HighJune 30, 2026
• activemq Bitnami Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console CVE-2026-49877 Fix available 8.1 HighJune 30, 2026
• activemq Bitnami Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation CVE-2026-50734 Fix available 7.5 HighJune 30, 2026
• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 CVE-2026-50750 Fix available 7.5 HighJune 30, 2026
• activemq Bitnami Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console CVE-2026-52760 Fix available 6.1 MediumJune 30, 2026
• activemq Bitnami Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec CVE-2026-53916 Fix available 7.5 HighJune 30, 2026
• activemq Bitnami Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling CVE-2026-53917 Fix available 7.5 HighJune 30, 2026
• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover CVE-2026-54475 Fix available 7.5 HighJune 30, 2026
• activemq Bitnami Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties CVE-2026-42253 Fix available 6.1 MediumJune 1, 2026
• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector CVE-2026-42588 Public exploitFix available 8.1 HighJune 1, 2026
• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass CVE-2026-45505 Fix available 8.8 HighJune 1, 2026
• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal CVE-2026-46605 Fix available 4.3 MediumJune 1, 2026
• activemq Bitnami Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default CVE-2026-49157 Fix available 8.8 HighJune 1, 2026
• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) CVE-2026-49270 Fix available 5.9 MediumJune 1, 2026
• activemq Bitnami Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia CVE-2026-41044 Public exploitFix available 8.8 HighApril 24, 2026
• activemq Bitnami Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues CVE-2026-41043 Fix available 6.5 MediumApril 24, 2026
• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI CVE-2026-40466 Fix available 8.8 HighApril 24, 2026
• activemq Bitnami Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM CVE-2026-39304 Fix available 7.5 HighApril 10, 2026
• activemq Bitnami Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated CVE-2026-40046 Fix available 7.5 HighApril 9, 2026
• activemq Bitnami Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory CVE-2026-33227 Fix available 4.3 MediumApril 7, 2026
• activemq Bitnami Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans CVE-2026-34197 In KEVPublic exploitFix available EPSS 98.3% 8.8 HighApril 7, 2026
• activemq Bitnami Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated CVE-2025-66168 Fix available 5.4 MediumMarch 4, 2026
• activemq Bitnami Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation CVE-2025-27533 Public exploitFix available 6.9 MediumMay 7, 2025
• activemq Bitnami Apache ActiveMQ: Jolokia and REST API were not secured with default configuration CVE-2024-32114 Public exploitFix available 8.5 HighMay 2, 2024
• activemq Bitnami Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE CVE-2022-41678 Public exploitFix available EPSS 85.8% 8.8 HighNovember 28, 2023
• activemq Bitnami Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack CVE-2023-46604 In KEVPublic exploitFix available EPSS 100.0% 10.0 CriticalOctober 27, 2023
• activemq Bitnami XStream is vulnerable to an Arbitrary Code Execution attack CVE-2021-21351 Fix available EPSS 82.1% 5.4 MediumMarch 22, 2021
• activemq Bitnami XStream is vulnerable to an Arbitrary Code Execution attack CVE-2021-21350 Fix available EPSS 15.2% 5.3 MediumMarch 22, 2021
• activemq Bitnami A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host CVE-2021-21349 Public exploitFix available EPSS 46.8% 6.1 MediumMarch 22, 2021
• activemq Bitnami XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) CVE-2021-21348 Fix available EPSS 13.8% 5.3 MediumMarch 22, 2021
• activemq Bitnami XStream is vulnerable to an Arbitrary Code Execution attack CVE-2021-21347 Fix available EPSS 14.3% 6.1 MediumMarch 22, 2021
• activemq Bitnami XStream is vulnerable to an Arbitrary Code Execution attack CVE-2021-21346 Fix available EPSS 76.4% 6.1 MediumMarch 22, 2021
• activemq Bitnami XStream is vulnerable to a Remote Command Execution attack CVE-2021-21345 Public exploitFix available EPSS 72.3% 5.8 MediumMarch 22, 2021
• activemq Bitnami XStream is vulnerable to an Arbitrary Code Execution attack CVE-2021-21344 Fix available EPSS 76.0% 5.3 MediumMarch 22, 2021
• activemq Bitnami XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights CVE-2021-21343 Fix available EPSS 46.7% 5.3 MediumMarch 22, 2021
• activemq Bitnami A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host CVE-2021-21342 Fix available EPSS 50.0% 5.3 MediumMarch 22, 2021
• activemq Bitnami XStream can cause a Denial of Service CVE-2021-21341 Public exploitFix available EPSS 77.8% 7.5 HighMarch 22, 2021
• activemq Bitnami Cross-site scripting (XSS) in Apache ActiveMQ CVE-2020-13947 Fix available EPSS 79.2% 6.1 MediumFebruary 8, 2021
• activemq Bitnami ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind CVE-2021-26117 Fix available EPSS 11.3% 7.5 HighJanuary 27, 2021
• activemq Bitnami Remote Code Execution in XStream CVE-2020-26217 Public exploitFix available EPSS 85.0% 8.0 HighNovember 16, 2020
• activemq Bitnami Remote code execution in Apache ActiveMQ CVE-2020-11998 Public exploitFix available EPSS 48.9% 9.8 CriticalSeptember 10, 2020
• activemq Bitnami Improper Authentication in Apache ActiveMQ CVE-2020-13920 Fix available 5.9 MediumSeptember 10, 2020
• activemq Bitnami Apache ActiveMQ webconsole admin GUI is open to XSS CVE-2020-1941 Fix available 6.1 MediumMay 14, 2020