Apache Activemq vulnerabilities

• apache activemq, activemq all, activemq broker +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId CVE-2026-74761 Fix available 7.5 HighSeptember 9, 2026
• apache activemq, activemq all, activemq amqp +2 more Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS CVE-2026-59878 Fix available 7.5 HighJuly 28, 2026
• apache activemq, activemq all, activemq broker +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations CVE-2026-61487 Fix available 6.5 MediumJuly 28, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker CVE-2026-49434 Fix available 7.5 HighJune 30, 2026
• apache activemq, apache software foundation activemq all, activemq stomp +2 more Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service CVE-2026-49432 Fix available 7.5 HighJune 30, 2026
• apache activemq Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console CVE-2026-49877 Fix available 8.1 HighJune 30, 2026
• apache activemq, apache software foundation activemq all, activemq client +2 more Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation CVE-2026-50734 Fix available 7.5 HighJune 30, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 CVE-2026-50750 Fix available 7.5 HighJune 30, 2026
• apache activemq, activemq web, apache software foundation activemq web console +2 more Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console CVE-2026-52760 Fix available 6.1 MediumJune 30, 2026
• apache activemq, apache software foundation activemq all, activemq stomp +2 more Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec CVE-2026-53916 Fix available 7.5 HighJune 30, 2026
• apache activemq, activemq broker, apache software foundation activemq all +1 more +3 more Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling CVE-2026-53917 Fix available 7.5 HighJune 30, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover CVE-2026-54475 Fix available 7.5 HighJune 30, 2026
• apache activemq, activemq web +1 more Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties CVE-2026-42253 Fix available 6.1 MediumJune 1, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector CVE-2026-42588 Public exploitFix available 8.1 HighJune 1, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass CVE-2026-45505 Fix available 8.8 HighJune 1, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal CVE-2026-46605 Fix available 4.3 MediumJune 1, 2026
• apache activemq Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default CVE-2026-49157 Fix available 8.8 HighJune 1, 2026
• apache activemq, activemq broker, apache software foundation activemq all +2 more Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) CVE-2026-49270 Fix available 5.9 MediumJune 1, 2026
• apache activemq, activemq broker, apache software foundation activemq all +8 more +10 more Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia CVE-2026-41044 Public exploitFix available 8.8 HighApril 24, 2026
• apache activemq, activemq web +1 more Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues CVE-2026-41043 Fix available 6.5 MediumApril 24, 2026
• apache activemq, activemq broker, apache software foundation activemq all +8 more +10 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI CVE-2026-40466 Fix available 8.8 HighApril 24, 2026
• apache activemq, activemq broker, apache software foundation activemq all +10 more +12 more Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM CVE-2026-39304 Fix available 7.5 HighApril 10, 2026
• apache activemq, activemq broker, activemq web +2 more +4 more Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory CVE-2026-33227 Fix available 4.3 MediumApril 7, 2026
• apache activemq, activemq broker, apache software foundation activemq all +8 more +10 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans CVE-2026-34197 In KEVPublic exploitFix available EPSS 98.3% 8.8 HighApril 7, 2026
• apache activemq, apache software foundation activemq all module, activemq mqtt module +2 more Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated CVE-2025-66168 Fix available 5.4 MediumMarch 4, 2026
• apache activemq-artemis, red hat amq broker 7, rhel-9 based middleware containers +2 more Amq: privilege escalation via excessive /etc/passwd permissions CVE-2025-58712 6.4 MediumOctober 22, 2025
• apache activemq nms amqp, apache software foundation activemq nms amqp client +1 more Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data CVE-2025-54539 Fix available 9.8 CriticalOctober 16, 2025
• apache activemq Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation CVE-2025-27533 Public exploitFix available 6.9 MediumMay 7, 2025
• apache activemq nms openwire, apache software foundation activemq nms openwire client +1 more Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass CVE-2025-29953 Fix available 9.8 CriticalApril 18, 2025
• apache activemq Apache ActiveMQ: Jolokia and REST API were not secured with default configuration CVE-2024-32114 Public exploitFix available 8.5 HighMay 2, 2024
• apache activemq Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE CVE-2022-41678 Public exploitFix available EPSS 85.8% 8.8 HighNovember 28, 2023
• apache activemq, activemq legacy openwire module, debian linux +3 more +5 more Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack CVE-2023-46604 In KEVPublic exploitFix available EPSS 100.0% 10.0 CriticalOctober 27, 2023
• x-stream xstream, apache activemq, jmeter +13 more +15 more XStream is vulnerable to an Arbitrary Code Execution attack CVE-2021-21351 Fix available EPSS 82.1% 5.4 MediumMarch 22, 2021
• x-stream xstream, apache activemq, jmeter +13 more +15 more XStream is vulnerable to an Arbitrary Code Execution attack CVE-2021-21350 Fix available EPSS 15.2% 5.3 MediumMarch 22, 2021
• x-stream xstream, apache activemq, jmeter +14 more +16 more A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host CVE-2021-21349 Public exploitFix available EPSS 46.8% 6.1 MediumMarch 22, 2021
• x-stream xstream, apache activemq, jmeter +13 more +15 more XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) CVE-2021-21348 Fix available EPSS 13.8% 5.3 MediumMarch 22, 2021
• x-stream xstream, apache activemq, jmeter +13 more +15 more XStream is vulnerable to an Arbitrary Code Execution attack CVE-2021-21347 Fix available EPSS 14.3% 6.1 MediumMarch 22, 2021
• x-stream xstream, apache activemq, jmeter +13 more +15 more XStream is vulnerable to an Arbitrary Code Execution attack CVE-2021-21346 Fix available EPSS 76.4% 6.1 MediumMarch 22, 2021
• x-stream xstream, apache activemq, jmeter +13 more +15 more XStream is vulnerable to a Remote Command Execution attack CVE-2021-21345 Public exploitFix available EPSS 72.3% 5.8 MediumMarch 22, 2021
• x-stream xstream, apache activemq, jmeter +13 more +15 more XStream is vulnerable to an Arbitrary Code Execution attack CVE-2021-21344 Fix available EPSS 76.0% 5.3 MediumMarch 22, 2021
• x-stream xstream, apache activemq, jmeter +12 more +14 more XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights CVE-2021-21343 Fix available EPSS 46.7% 5.3 MediumMarch 22, 2021
• x-stream xstream, apache activemq, jmeter +12 more +14 more A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host CVE-2021-21342 Fix available EPSS 50.0% 5.3 MediumMarch 22, 2021
• x-stream xstream, apache activemq, jmeter +10 more +12 more XStream can cause a Denial of Service CVE-2021-21341 Public exploitFix available EPSS 77.8% 7.5 HighMarch 22, 2021
• apache activemq, oracle communications session report manager, communications session route manager +2 more Cross-site scripting (XSS) in Apache ActiveMQ CVE-2020-13947 Fix available EPSS 79.2% 6.1 MediumFebruary 8, 2021
• apache activemq, artemis, debian linux +5 more +7 more ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind CVE-2021-26117 Fix available EPSS 11.3% 7.5 HighJanuary 27, 2021
• x-stream xstream, apache activemq, debian linux +12 more +14 more Remote Code Execution in XStream CVE-2020-26217 Public exploitFix available EPSS 85.0% 8.0 HighNovember 16, 2020
• apache activemq, oracle communications diameter signaling router, communications element manager +4 more +6 more Remote code execution in Apache ActiveMQ CVE-2020-11998 Public exploitFix available EPSS 48.9% 9.8 CriticalSeptember 10, 2020
• apache activemq, debian linux, oracle communications diameter signaling router +1 more +3 more Improper Authentication in Apache ActiveMQ CVE-2020-13920 Fix available 5.9 MediumSeptember 10, 2020
• apache activemq, oracle communications diameter signaling router, communications element manager +4 more +6 more Apache ActiveMQ webconsole admin GUI is open to XSS CVE-2020-1941 Fix available 6.1 MediumMay 14, 2020
• apache zookeeper, activemq, drill +7 more +9 more Access control bypass in Apache ZooKeeper CVE-2019-0201 Fix available 5.9 MediumMay 23, 2019
• Show olderLoading…