activemq vulnerabilities (Debian)

50 vulnerabilities.

• activemq Debian Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection CVE-2026-108500 No scoreNovember 4, 2026
• activemq Debian Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection CVE-2026-108946 No scoreNovember 4, 2026
• activemq Debian Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation CVE-2026-111822 No scoreNovember 4, 2026
• activemq Debian Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal CVE-2026-111821 No scoreNovember 4, 2026
• activemq Debian Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM CVE-2026-108949 6.5 MediumNovember 4, 2026
• activemq Debian Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS CVE-2026-59878 Fix available 7.5 HighJuly 28, 2026
• activemq Debian Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations CVE-2026-61487 Fix available 6.5 MediumJuly 28, 2026
• activemq Debian Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker CVE-2026-49434 Fix available 7.5 HighJune 30, 2026
• activemq Debian Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service CVE-2026-49432 Fix available 7.5 HighJune 30, 2026
• activemq Debian Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console CVE-2026-49877 Fix available 8.1 HighJune 30, 2026
• activemq Debian Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation CVE-2026-50734 Fix available 7.5 HighJune 30, 2026
• activemq Debian Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 CVE-2026-50750 Fix available 7.5 HighJune 30, 2026
• activemq Debian Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console CVE-2026-52760 Fix available 6.1 MediumJune 30, 2026
• activemq Debian Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec CVE-2026-53916 Fix available 7.5 HighJune 30, 2026
• activemq Debian Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling CVE-2026-53917 Fix available 7.5 HighJune 30, 2026
• activemq Debian Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover CVE-2026-54475 Fix available 7.5 HighJune 30, 2026
• activemq Debian Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties CVE-2026-42253 Fix available 6.1 MediumJune 1, 2026
• activemq Debian Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector CVE-2026-42588 Public exploitFix available 8.1 HighJune 1, 2026
• activemq Debian Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass CVE-2026-45505 Fix available 8.8 HighJune 1, 2026
• activemq Debian Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal CVE-2026-46605 Fix available 4.3 MediumJune 1, 2026
• activemq Debian Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default CVE-2026-49157 Fix available 8.8 HighJune 1, 2026
• activemq Debian Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) CVE-2026-49270 Fix available 5.9 MediumJune 1, 2026
• activemq Debian Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia CVE-2026-41044 Public exploitFix available 8.8 HighApril 24, 2026
• activemq Debian Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues CVE-2026-41043 Fix available 6.5 MediumApril 24, 2026
• activemq Debian Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI CVE-2026-40466 Fix available 8.8 HighApril 24, 2026
• activemq Debian Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM CVE-2026-39304 Fix available 7.5 HighApril 10, 2026
• activemq Debian Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory CVE-2026-33227 Fix available 4.3 MediumApril 7, 2026
• activemq Debian Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans CVE-2026-34197 In KEVPublic exploitFix available EPSS 98.3% 8.8 HighApril 7, 2026
• activemq Debian Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated CVE-2025-66168 Fix available 5.4 MediumMarch 4, 2026
• activemq Debian Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation CVE-2025-27533 Public exploitFix available 6.9 MediumMay 7, 2025
• activemq Debian Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE CVE-2022-41678 Public exploitFix available EPSS 85.7% 8.8 HighNovember 28, 2023
• activemq Debian Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack CVE-2023-46604 In KEVPublic exploitFix available EPSS 100.0% 10.0 CriticalOctober 27, 2023
• activemq Debian Cross-site scripting (XSS) in Apache ActiveMQ CVE-2020-13947 Fix available EPSS 79.2% 6.1 MediumFebruary 8, 2021
• activemq Debian ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind CVE-2021-26117 Fix available EPSS 11.3% 7.5 HighJanuary 27, 2021
• activemq Debian Improper Authentication in Apache ActiveMQ CVE-2020-13920 Fix available 5.9 MediumSeptember 10, 2020
• activemq Debian Apache ActiveMQ webconsole admin GUI is open to XSS CVE-2020-1941 Fix available 6.1 MediumMay 14, 2020
• activemq Debian Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client CVE-2019-0222 Public exploitFix available EPSS 12.0% 7.5 HighMarch 28, 2019
• activemq Debian Apache ActiveMQ web console vulnerable to Cross-site Scripting CVE-2018-8006 Fix available EPSS 55.7% 6.1 MediumOctober 10, 2018
• activemq Debian Improper Certificate Validation in Apache activemq-client CVE-2018-11775 Fix available 7.4 HighSeptember 10, 2018
• activemq Debian ActiveMQ's OpenWire protocol exposes certain system details as plain text CVE-2017-15709 Fix available EPSS 22.8% 3.7 LowFebruary 13, 2018
• activemq Debian Improper Neutralization of Input During Web Page Generation Apache ActiveMQ CVE-2016-6810 Fix available 6.1 MediumJanuary 10, 2018
• activemq Debian Improper Restriction of XML External Entity Reference in Apache ActiveMQ CVE-2014-3600 Fix available 9.8 CriticalOctober 27, 2017
• activemq Debian Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ CVE-2015-7559 Fix available 2.7 LowApril 24, 2017
• activemq Debian Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ CVE-2016-0782 Fix available 5.4 MediumAugust 5, 2016
• activemq Debian Improper Input Validation in Apache ActiveMQ CVE-2016-3088 In KEVPublic exploitFix available EPSS 98.4% 9.8 CriticalJune 1, 2016
• activemq Debian Improper Input Validation in Apache ActiveMQ CVE-2015-5254 Public exploitFix available EPSS 38.2% 9.8 CriticalJanuary 8, 2016
• activemq Debian Improper Input Validation in Apache ActiveMQ CVE-2015-6524 Fix available 5.0 MediumAugust 24, 2015
• activemq Debian Improper Authentication in Apache WSS4J CVE-2014-3612 Fix available 7.5 HighAugust 24, 2015
• activemq Debian Improper Neutralization of Special Elements used in an OS Command in Apache ActiveMQ CVE-2014-3576 Public exploitFix available EPSS 12.8% 7.5 HighAugust 7, 2015
• activemq Debian Denial of Service in Apache ActiveMQ CVE-2011-4905 Fix available 5.0 MediumJanuary 5, 2012