org.apache.activemq:activemq-all vulnerabilities (Maven)

17 vulnerabilities.

• org.apache.activemq:activemq-all Maven Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker CVE-2026-49434 Fix available 7.5 HighJune 30, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service CVE-2026-49432 Fix available 7.5 HighJune 30, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation CVE-2026-50734 Fix available 7.5 HighJune 30, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 CVE-2026-50750 Fix available 7.5 HighJune 30, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling CVE-2026-53917 Fix available 7.5 HighJune 30, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover CVE-2026-54475 Fix available 7.5 HighJune 30, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector CVE-2026-42588 Public exploitFix available 8.1 HighJune 1, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass CVE-2026-45505 Fix available 8.8 HighJune 1, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) CVE-2026-49270 Fix available 5.9 MediumJune 1, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia CVE-2026-41044 Public exploitFix available 8.8 HighApril 24, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues CVE-2026-41043 Fix available 6.5 MediumApril 24, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI CVE-2026-40466 Fix available 8.8 HighApril 24, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM CVE-2026-39304 Fix available 7.5 HighApril 10, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated CVE-2026-40046 Fix available 7.5 HighApril 9, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory CVE-2026-33227 Fix available 4.3 MediumApril 7, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans CVE-2026-34197 In KEVPublic exploitFix available EPSS 98.3% 8.8 HighApril 7, 2026
• org.apache.activemq:activemq-all Maven Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated CVE-2025-66168 Fix available 5.4 MediumMarch 4, 2026