MavenPackage

org.apache.activemq:activemq-all

22 known vulnerabilities (16 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release: 6.4.0 (Oct 22, 2026): no advisory affects it
Newest unaffected release: 6.4.0 (Oct 22, 2026), the latest release
Advisories: 22 · 16 high, 6 medium

Dependents: 29
Releases: 124 since 4.1.2 (Apr 14, 2008)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-74761
Affects 4.1.2 to 5.19.10 (5.19.11 is outside it); 6.0.0 to 6.3.1 (6.3.2 is outside it)
CVE-2026-59878
Affects 4.1.2 to 5.19.8 (5.19.9 is outside it); 6.0.0 to 6.2.7 (6.2.8 is outside it)
CVE-2026-61487
Affects 4.1.2 to 5.19.8 (5.19.9 is outside it); 6.0.0 to 6.2.7 (6.2.8 is outside it)
CVE-2026-49434
Affects 4.1.2 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
CVE-2026-49432
Affects 4.1.2 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
CVE-2026-50734
Affects 4.1.2 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
CVE-2026-50750
Affects 5.19.7 (5.19.8 is outside it); 6.2.6 (6.2.7 is outside it)
CVE-2026-53916
Affects 4.1.2 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
CVE-2026-53917
Affects 4.1.2 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
CVE-2026-54475
Affects 4.1.2 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
CVE-2026-42588
Affects 4.1.2 to 5.19.6 (5.19.7 is outside it); 6.0.0 to 6.2.5 (6.2.6 is outside it)
CVE-2026-45505
Affects 4.1.2 to 5.19.6 (5.19.7 is outside it); 6.0.0 to 6.2.5 (6.2.6 is outside it)

Show all 22 advisoriesShow fewer advisories

CVE-2026-46605
Affects 4.1.2 to 5.19.6 (5.19.7 is outside it); 6.0.0 to 6.2.5 (6.2.6 is outside it)
CVE-2026-49270
Affects 4.1.2 to 5.19.6 (5.19.7 is outside it); 6.0.0 to 6.2.5 (6.2.6 is outside it)
CVE-2026-41044
Affects 4.1.2 to 5.19.5 (5.19.6 is outside it); 6.0.0 to 6.2.4 (6.2.5 is outside it)
CVE-2026-41043
Affects 4.1.2 to 5.19.5 (5.19.6 is outside it); 6.0.0 to 6.2.4 (6.2.5 is outside it)
CVE-2026-40466
Affects 4.1.2 to 5.19.5 (5.19.6 is outside it); 6.0.0 to 6.2.4 (6.2.5 is outside it)
CVE-2026-39304
Affects 4.1.2 to 5.19.3 (5.19.4 is outside it); 6.0.0 to 6.2.3 (6.2.4 is outside it)
CVE-2026-40046
Affects 6.0.0 to 6.2.3 (6.2.4 is outside it)
CVE-2026-33227
Affects 4.1.2 to 5.19.2 (5.19.3 is outside it); 6.0.0 to 6.2.1 (6.2.2 is outside it)
CVE-2026-34197
Affects 4.1.2 to 5.19.4 (5.19.5 is outside it); 6.0.0 to 6.2.2 (6.2.3 is outside it)
CVE-2025-66168
Affects 4.1.2 to 5.19.1 (5.19.2 is outside it); 6.0.0 to 6.2.0 (6.2.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 22

CVE-2026-74761High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
Affected: from 6.0.0, fixed in 6.3.2; fixed in 5.19.11.
Fixed in 5.19.11 (released Sep 2, 2026, 7 days before disclosure) and 6.3.2 (released Aug 29, 2026, 11 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-59878High 7.5
Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS
Affected: fixed in 5.19.9; from 6.0.0, fixed in 6.2.8.
Fixed in 5.19.9 (released Jul 24, 2026, 4 days before disclosure) and 6.2.8 (released Jul 24, 2026, 4 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-61487Medium 6.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations
Affected: fixed in 5.19.9; from 6.0.0, fixed in 6.2.8.
Fixed in 5.19.9 (released Jul 24, 2026, 4 days before disclosure) and 6.2.8 (released Jul 24, 2026, 4 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-49434High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties…
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-49432High 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-50734High 7.5
Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format…
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-50750High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270
Affected: from 5.19.7, fixed in 5.19.8; from 6.2.6, fixed in 6.2.7; from 5.19.7, fixed in 5.19.8; from 6.2.6, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-53916High 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-53917High 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property…
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-54475High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-42588High 8.1
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
Fixed in 5.19.7 (released May 27, 2026, 5 days before disclosure) and 6.2.6 (released May 27, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-45505High 8.8
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
Fixed in 5.19.7 (released May 27, 2026, 5 days before disclosure) and 6.2.6 (released May 27, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-46605Medium 4.3
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
Fixed in 5.19.7 (released May 27, 2026, 5 days before disclosure) and 6.2.6 (released May 27, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-49270Medium 5.9
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)
Affected: from 5.14.0, fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
Fixed in 5.19.7 (released May 27, 2026, 5 days before disclosure) and 6.2.6 (released May 27, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-41044High 8.8
Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by…
Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5; fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.
Fixed in 5.19.6 (released Apr 21, 2026, 3 days before disclosure) and 6.2.5 (released Apr 21, 2026, 3 days before disclosure).
The latest release, 6.4.0, is not affected.

Show all 22 advisoriesShow fewer advisories

CVE-2026-41043Medium 6.5
Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues
Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.
Fixed in 5.19.6 (released Apr 21, 2026, 3 days before disclosure) and 6.2.5 (released Apr 21, 2026, 3 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-40466High 8.8
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5; fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.
Fixed in 5.19.6 (released Apr 21, 2026, 3 days before disclosure) and 6.2.5 (released Apr 21, 2026, 3 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-39304High 7.5
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be…
Affected: fixed in 5.19.4; from 6.0.0, fixed in 6.2.4; fixed in 5.19.4; from 6.0.0, fixed in 6.2.4.
Fixed in 5.19.4 (released Mar 28, 2026, 13 days before disclosure) and 6.2.4 (released Apr 8, 2026, 2 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-40046High 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is…
Affected: from 6.0.0, fixed in 6.2.4; from 6.0.0, fixed in 6.2.4.
Fixed in 6.2.4 (released Apr 8, 2026, 1 day before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-33227Medium 4.3
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a…
Affected: fixed in 5.19.3; from 6.0.0, fixed in 6.2.2; fixed in 5.19.3; from 6.0.0, fixed in 6.2.2.
Fixed in 5.19.3 (released Mar 20, 2026, 18 days before disclosure) and 6.2.2 (released Mar 20, 2026, 18 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-34197High 8.8 · KEV
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Affected: fixed in 5.19.5; from 6.0.0, fixed in 6.2.3.
Fixed in 5.19.5 (released Apr 8, 2026, 1 day after disclosure) and 6.2.3 (released Mar 27, 2026, 11 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2025-66168Medium 5.4
Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly…
Affected: fixed in 5.19.2; from 6.0.0, fixed in 6.1.9; from 6.2.0, fixed in 6.2.1; fixed in 5.19.2; from 6.0.0, fixed in 6.1.9; from 6.2.0, fixed in 6.2.1.
Fixed in 5.19.2 (released Feb 6, 2026, 26 days before disclosure) and 6.2.1 (released Feb 12, 2026, 20 days before disclosure, the advisory names 6.1.9, which was never published).
The latest release, 6.4.0, is not affected.