Apache Software Foundation Apache ActiveMQ All vulnerabilities (CVE)

CVE records published for Apache Software Foundation Apache ActiveMQ All, newest first. Follow to get an email when a new one appears.

20 results

7.5High

CVE-2026-74761 1 month ago

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Bro…

7.5High

CVE-2026-59878 3 months ago

Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS

Apache Software Foundation Apache ActiveMQ AMQP; Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause…

6.5Medium

CVE-2026-61487 3 months ago

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is…

7.5High

CVE-2026-49434 4 months ago

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All

Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports …

7.5High

CVE-2026-49432 4 months ago

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service

Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ Stomp

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For t…

7.5High

CVE-2026-50734 4 months ago

Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation

Apache Software Foundation Apache ActiveMQ Client; Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value.…

7.5High

CVE-2026-50750 4 months ago

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without s…

7.5High

CVE-2026-53916 4 months ago

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec

Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ Stomp

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer th…

7.5High

CVE-2026-53917 4 months ago

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling

Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ Client; Apache Software Foundation Apache ActiveMQ Broker

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size va…

7.5High

CVE-2026-54475 4 months ago

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only c…

8.1High

CVE-2026-42588 5 months ago

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web consol…

8.8High

CVE-2026-45505 5 months ago

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...`…

4.3Medium

CVE-2026-46605 5 months ago

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6;…

5.9Medium

CVE-2026-49270 5 months ago

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated atta…

8.8High

CVE-2026-41044 6 months ago

Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Red Hat Red Hat AMQ Broker 7

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker n…

8.8High

CVE-2026-40466 6 months ago

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ; Red Hat Red Hat AMQ Broker 7

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using a…

4.8%EPSS

7.5High

CVE-2026-39304 6 months ago

Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM

Apache Software Foundation Apache ActiveMQ Client; Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client t…

7.5High

CVE-2026-40046 6 months ago

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated

Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ MQTT

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) rele…

4.3Medium

CVE-2026-33227 6 months ago

Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory

Apache Software Foundation Apache ActiveMQ Client; Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ Web

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing m…

8.8High

CVE-2026-34197 KEV 6 months ago

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ; Red Hat Red Hat AMQ Broker 7

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Joloki…

98%EPSS