Skip to contentApache Software Foundation Activemq All vulnerabilities
- apache activemq, activemq all, activemq broker +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientIdCVE-2026-74761Fix available7.5 High
- apache activemq, activemq all, activemq amqp +2 moreApache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoSCVE-2026-59878Fix available7.5 High
- apache activemq, activemq all, activemq broker +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinationsCVE-2026-61487Fix available6.5 Medium
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties brokerCVE-2026-49434Fix available7.5 High
- apache activemq, apache software foundation activemq all, activemq stomp +2 moreApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of serviceCVE-2026-49432Fix available7.5 High
- apache activemq, apache software foundation activemq all, activemq client +2 moreApache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiationCVE-2026-50734Fix available7.5 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270CVE-2026-50750Fix available7.5 High
- apache activemq, apache software foundation activemq all, activemq stomp +2 moreApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codecCVE-2026-53916Fix available7.5 High
- apache activemq, activemq broker, apache software foundation activemq all +1 more +3 moreApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshallingCVE-2026-53917Fix available7.5 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeoverCVE-2026-54475Fix available7.5 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnectorCVE-2026-42588Public exploitFix available8.1 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper BypassCVE-2026-45505Fix available8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removalCVE-2026-46605Fix available4.3 Medium
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)CVE-2026-49270Fix available5.9 Medium
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by JolokiaCVE-2026-41044Public exploitFix available8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URICVE-2026-40466Fix available8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +10 more +12 moreApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOMCVE-2026-39304Fix available7.5 High
- apache software foundation activemq, activemq all, activemq mqtt +2 moreApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validatedCVE-2026-40046Fix available7.5 High
- apache activemq, activemq broker, activemq web +2 more +4 moreApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath DirectoryCVE-2026-33227Fix available4.3 Medium
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansCVE-2026-34197In KEVPublic exploitFix availableEPSS 98.3%8.8 High
- apache activemq, apache software foundation activemq all module, activemq mqtt module +2 moreApache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validatedCVE-2025-66168Fix available5.4 Medium