IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al

apache activemq güvenlik açıkları (CVE)

apache activemq için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

28 sonuç
7.5Yüksek
CVE-2026-74761

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Bro…

7.5Yüksek
CVE-2026-59878

Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS

Apache Software Foundation Apache ActiveMQ AMQP; Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause…

6.5Orta
CVE-2026-61487

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is…

7.5Yüksek
CVE-2026-49434

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All

Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports …

7.5Yüksek
CVE-2026-49432

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service

Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ Stomp

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For t…

7.5Yüksek
CVE-2026-50734

Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation

Apache Software Foundation Apache ActiveMQ Client; Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value.…

7.5Yüksek
CVE-2026-50750

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without s…

7.5Yüksek
CVE-2026-53916

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec

Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ Stomp

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer th…

7.5Yüksek
CVE-2026-53917

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling

Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ Client; Apache Software Foundation Apache ActiveMQ Broker

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size va…

7.5Yüksek
CVE-2026-54475

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only c…

8.1Yüksek
CVE-2026-42588

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web consol…

8.8Yüksek
CVE-2026-45505

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...`…

4.3Orta
CVE-2026-46605

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6;…

5.9Orta
CVE-2026-49270

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated atta…

8.8Yüksek
CVE-2026-41044

Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Red Hat Red Hat AMQ Broker 7

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker n…

8.8Yüksek
CVE-2026-40466

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ; Red Hat Red Hat AMQ Broker 7

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using a…

4.8%EPSS
7.5Yüksek
CVE-2026-39304

Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM

Apache Software Foundation Apache ActiveMQ Client; Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client t…

4.3Orta
CVE-2026-33227

Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory

Apache Software Foundation Apache ActiveMQ Client; Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ Web

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing m…

8.8Yüksek
CVE-2026-34197 KEV

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Apache Software Foundation Apache ActiveMQ Broker; Apache Software Foundation Apache ActiveMQ All; Apache Software Foundation Apache ActiveMQ; Red Hat Red Hat AMQ Broker 7

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Joloki…

98%EPSS
5.4Orta
CVE-2025-66168

Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated

Apache Software Foundation Apache ActiveMQ; Apache Software Foundation Apache ActiveMQ All Module; Apache Software Foundation Apache ActiveMQ MQTT Module

WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the  following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord…