MavenPackage

org.apache.activemq:activemq-broker

21 known vulnerabilities (11 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release: 6.4.0 (Oct 22, 2026): no advisory affects it
Newest unaffected release: 6.4.0 (Oct 22, 2026), the latest release
Advisories: 21 · 11 high, 6 medium

Dependents: 68
Releases: 109 since 5.8.0 (Feb 6, 2013)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-108946
Affects 5.8.0 to 5.19.11 (5.19.12 is outside it); 6.0.0 to 6.3.2 (6.3.3 is outside it)
CVE-2026-108949
Affects 5.8.0 to 5.19.11 (5.19.12 is outside it); 6.0.0 to 6.3.2 (6.3.3 is outside it)
CVE-2026-74761
Affects 5.8.0 to 5.19.10 (5.19.11 is outside it); 6.0.0 to 6.3.1 (6.3.2 is outside it)
CVE-2026-61487
Affects 5.8.0 to 5.19.8 (5.19.9 is outside it); 6.0.0 to 6.2.7 (6.2.8 is outside it)
CVE-2026-49434
Affects 5.8.0 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
CVE-2026-50750
Affects 5.19.7 (5.19.8 is outside it); 6.2.6 (6.2.7 is outside it)
CVE-2026-53917
Affects 5.8.0 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
CVE-2026-54475
Affects 5.8.0 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
CVE-2026-42588
Affects 5.8.0 to 5.19.6 (5.19.7 is outside it); 6.0.0 to 6.2.5 (6.2.6 is outside it)
CVE-2026-45505
Affects 5.8.0 to 5.19.6 (5.19.7 is outside it); 6.0.0 to 6.2.5 (6.2.6 is outside it)
CVE-2026-46605
Affects 5.8.0 to 5.19.6 (5.19.7 is outside it); 6.0.0 to 6.2.5 (6.2.6 is outside it)
CVE-2026-49270
Affects 5.8.0 to 5.19.6 (5.19.7 is outside it); 6.0.0 to 6.2.5 (6.2.6 is outside it)

Show all 21 advisoriesShow fewer advisories

CVE-2026-41044
Affects 5.8.0 to 5.19.5 (5.19.6 is outside it); 6.0.0 to 6.2.4 (6.2.5 is outside it)
CVE-2026-41043
Affects 5.8.0 to 5.19.5 (5.19.6 is outside it); 6.0.0 to 6.2.4 (6.2.5 is outside it)
CVE-2026-40466
Affects 5.8.0 to 5.19.5 (5.19.6 is outside it); 6.0.0 to 6.2.4 (6.2.5 is outside it)
CVE-2026-39304
Affects 5.8.0 to 5.19.3 (5.19.4 is outside it); 6.0.0 to 6.2.3 (6.2.4 is outside it)
CVE-2026-33227
Affects 5.8.0 to 5.19.2 (5.19.3 is outside it); 6.0.0 to 6.2.1 (6.2.2 is outside it)
CVE-2026-34197
Affects 5.8.0 to 5.19.4 (5.19.5 is outside it); 6.0.0 to 6.2.2 (6.2.3 is outside it)
CVE-2014-3600
Affects 5.8.0 to 5.10.0 (5.10.1 is outside it)
CVE-2015-6524
Affects 5.8.0 to 5.10.1 (5.10.2 is outside it)
CVE-2014-3612
Affects 5.8.0 to 5.10.0 (5.10.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 21

CVE-2026-108946Unrated
Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
Affected: from 6.0.0, fixed in 6.3.3; fixed in 5.19.12.
Fixed in 5.19.12 (released Oct 22, 2026, 13 days before disclosure) and 6.3.3 (released Oct 22, 2026, 13 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-108949Medium 6.5
Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM
Affected: from 6.0.0, fixed in 6.3.3; fixed in 5.19.12; from 6.0.0, fixed in 6.3.3; fixed in 5.19.12.
Fixed in 5.19.12 (released Oct 22, 2026, 13 days before disclosure) and 6.3.3 (released Oct 22, 2026, 13 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-74761High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
Affected: from 6.0.0, fixed in 6.3.2; fixed in 5.19.11.
Fixed in 5.19.11 (released Sep 2, 2026, 7 days before disclosure) and 6.3.2 (released Aug 29, 2026, 11 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-61487Medium 6.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations
Affected: fixed in 5.19.9; from 6.0.0, fixed in 6.2.8.
Fixed in 5.19.9 (released Jul 24, 2026, 4 days before disclosure) and 6.2.8 (released Jul 24, 2026, 4 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-49434High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties…
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-50750High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270
Affected: from 5.19.7, fixed in 5.19.8; from 6.2.6, fixed in 6.2.7; from 5.19.7, fixed in 5.19.8; from 6.2.6, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-53917High 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property…
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-54475High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-42588High 8.1
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
Fixed in 5.19.7 (released May 27, 2026, 5 days before disclosure) and 6.2.6 (released May 27, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-45505High 8.8
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
Fixed in 5.19.7 (released May 27, 2026, 5 days before disclosure) and 6.2.6 (released May 27, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-46605Medium 4.3
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
Fixed in 5.19.7 (released May 27, 2026, 5 days before disclosure) and 6.2.6 (released May 27, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-49270Medium 5.9
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)
Affected: from 5.14.0, fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
Fixed in 5.19.7 (released May 27, 2026, 5 days before disclosure) and 6.2.6 (released May 27, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-41044High 8.8
Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by…
Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5; fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.
Fixed in 5.19.6 (released Apr 21, 2026, 3 days before disclosure) and 6.2.5 (released Apr 21, 2026, 3 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-41043Medium 6.5
Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues
Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.
Fixed in 5.19.6 (released Apr 21, 2026, 3 days before disclosure) and 6.2.5 (released Apr 21, 2026, 3 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-40466High 8.8
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5; fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.
Fixed in 5.19.6 (released Apr 21, 2026, 3 days before disclosure) and 6.2.5 (released Apr 21, 2026, 3 days before disclosure).
The latest release, 6.4.0, is not affected.

Show all 21 advisoriesShow fewer advisories

CVE-2026-39304High 7.5
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be…
Affected: fixed in 5.19.4; from 6.0.0, fixed in 6.2.4; fixed in 5.19.4; from 6.0.0, fixed in 6.2.4.
Fixed in 5.19.4 (released Mar 28, 2026, 13 days before disclosure) and 6.2.4 (released Apr 8, 2026, 2 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-33227Medium 4.3
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a…
Affected: fixed in 5.19.3; from 6.0.0, fixed in 6.2.2; fixed in 5.19.3; from 6.0.0, fixed in 6.2.2.
Fixed in 5.19.3 (released Mar 20, 2026, 18 days before disclosure) and 6.2.2 (released Mar 20, 2026, 18 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2026-34197High 8.8 · KEV
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Affected: fixed in 5.19.5; from 6.0.0, fixed in 6.2.3.
Fixed in 5.19.5 (released Apr 8, 2026, 1 day after disclosure) and 6.2.3 (released Mar 27, 2026, 11 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2014-3600Unrated
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via…
Affected: from 5.0.0, fixed in 5.10.1.
Fixed in 5.10.1 (released Jan 15, 2015, 1016 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2015-6524Unrated
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows…
Affected: from 5.0.0, fixed in 5.10.2.
Fixed in 5.10.2 (released Feb 13, 2015, 192 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2014-3612Unrated
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows…
Affected: from 5.0.0, fixed in 5.10.1.
Fixed in 5.10.1 (released Jan 15, 2015, 221 days before disclosure).
The latest release, 6.4.0, is not affected.