Apache Software Foundation Activemq vulnerabilities

• apache software foundation activemq Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection CVE-2026-108500 No scoreNovember 4, 2026
• apache software foundation activemq nms openwire client library Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS) CVE-2026-103582 No scoreNovember 4, 2026
• apache software foundation activemq broker, activemq +1 more Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection CVE-2026-108946 No scoreNovember 4, 2026
• apache software foundation activemq, activemq runtime config +1 more Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation CVE-2026-111822 No scoreNovember 4, 2026
• apache software foundation activemq, activemq kahadb +1 more Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal CVE-2026-111821 No scoreNovember 4, 2026
• apache software foundation activemq broker, activemq +1 more Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM CVE-2026-108949 6.5 MediumNovember 4, 2026
• apache artemis, apache software foundation activemq artemis +1 more Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation CVE-2026-49362 Fix available 7.5 HighSeptember 10, 2026
• apache artemis, apache software foundation activemq artemis +1 more Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription CVE-2026-49363 7.5 HighSeptember 10, 2026
• apache artemis, apache software foundation activemq artemis +1 more Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers CVE-2026-49364 9.1 CriticalSeptember 10, 2026
• apache artemis, apache software foundation activemq artemis +1 more Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service CVE-2026-57822 6.5 MediumSeptember 10, 2026
• apache artemis, apache software foundation activemq artemis +1 more Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment CVE-2026-57967 Public exploit 9.8 CriticalSeptember 10, 2026
• apache artemis, apache software foundation activemq artemis +1 more Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion CVE-2026-67593 9.1 CriticalSeptember 10, 2026
• apache artemis, apache software foundation activemq artemis +1 more Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service CVE-2026-75880 6.5 MediumSeptember 10, 2026
• apache activemq, activemq all, activemq broker +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId CVE-2026-74761 Fix available 7.5 HighSeptember 9, 2026
• apache activemq, activemq all, activemq amqp +2 more Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS CVE-2026-59878 Fix available 7.5 HighJuly 28, 2026
• apache activemq, activemq all, activemq broker +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations CVE-2026-61487 Fix available 6.5 MediumJuly 28, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker CVE-2026-49434 Fix available 7.5 HighJune 30, 2026
• apache activemq, apache software foundation activemq all, activemq stomp +2 more Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service CVE-2026-49432 Fix available 7.5 HighJune 30, 2026
• apache activemq Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console CVE-2026-49877 Fix available 8.1 HighJune 30, 2026
• apache activemq, apache software foundation activemq all, activemq client +2 more Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation CVE-2026-50734 Fix available 7.5 HighJune 30, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 CVE-2026-50750 Fix available 7.5 HighJune 30, 2026
• apache activemq, activemq web, apache software foundation activemq web console +2 more Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console CVE-2026-52760 Fix available 6.1 MediumJune 30, 2026
• apache activemq, apache software foundation activemq all, activemq stomp +2 more Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec CVE-2026-53916 Fix available 7.5 HighJune 30, 2026
• apache activemq, activemq broker, apache software foundation activemq all +1 more +3 more Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling CVE-2026-53917 Fix available 7.5 HighJune 30, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover CVE-2026-54475 Fix available 7.5 HighJune 30, 2026
• apache activemq, activemq web +1 more Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties CVE-2026-42253 Fix available 6.1 MediumJune 1, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector CVE-2026-42588 Public exploitFix available 8.1 HighJune 1, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass CVE-2026-45505 Fix available 8.8 HighJune 1, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal CVE-2026-46605 Fix available 4.3 MediumJune 1, 2026
• apache activemq Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default CVE-2026-49157 Fix available 8.8 HighJune 1, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) CVE-2026-49270 Fix available 5.9 MediumJune 1, 2026
• apache artemis, apache software foundation activemq artemis stomp protocol, artemis stomp protocol +2 more Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission CVE-2026-40914 Fix available 4.3 MediumMay 28, 2026
• apache activemq, activemq broker, apache software foundation activemq all +8 more +10 more Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia CVE-2026-41044 Public exploitFix available 8.8 HighApril 24, 2026
• apache activemq, activemq web +1 more Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues CVE-2026-41043 Fix available 6.5 MediumApril 24, 2026
• apache activemq, activemq broker, apache software foundation activemq all +8 more +10 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI CVE-2026-40466 Fix available 8.8 HighApril 24, 2026
• apache activemq, activemq broker, apache software foundation activemq all +10 more +12 more Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM CVE-2026-39304 Fix available 7.5 HighApril 10, 2026
• apache software foundation activemq, activemq all, activemq mqtt +2 more Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated CVE-2026-40046 Fix available 7.5 HighApril 9, 2026
• apache activemq, activemq broker, activemq web +2 more +4 more Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory CVE-2026-33227 Fix available 4.3 MediumApril 7, 2026
• apache activemq, activemq broker, apache software foundation activemq all +8 more +10 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans CVE-2026-34197 In KEVPublic exploitFix available EPSS 98.3% 8.8 HighApril 7, 2026
• apache artemis, apache software foundation activemq artemis +1 more Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission CVE-2026-32642 Fix available 2.3 LowMarch 24, 2026
• apache artemis, apache software foundation activemq artemis, red hat amq broker 7.12.6 +17 more +19 more Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation CVE-2026-27446 Fix available EPSS 11.4% 9.3 CriticalMarch 4, 2026
• apache activemq, apache software foundation activemq all module, activemq mqtt module +2 more Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated CVE-2025-66168 Fix available 5.4 MediumMarch 4, 2026
• apache activemq nms amqp, apache software foundation activemq nms amqp client +1 more Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data CVE-2025-54539 Fix available 9.8 CriticalOctober 16, 2025
• apache activemq Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation CVE-2025-27533 Public exploitFix available 6.9 MediumMay 7, 2025
• apache activemq nms openwire, apache software foundation activemq nms openwire client +1 more Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass CVE-2025-29953 Fix available 9.8 CriticalApril 18, 2025
• apache artemis, apache software foundation activemq artemis +1 more Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log CVE-2025-27391 Fix available 6.8 MediumApril 9, 2025
• apache artemis, apache software foundation activemq artemis +1 more Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission CVE-2025-27427 Fix available 2.3 LowApril 1, 2025
• apache artemis, apache software foundation activemq artemis +1 more Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans CVE-2023-50780 Public exploitFix available EPSS 17.5% 8.8 HighOctober 14, 2024
• apache activemq Apache ActiveMQ: Jolokia and REST API were not secured with default configuration CVE-2024-32114 Public exploitFix available 8.5 HighMay 2, 2024
• apache activemq Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE CVE-2022-41678 Public exploitFix available EPSS 85.7% 8.8 HighNovember 28, 2023
• Show olderLoading…