Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.activemq:activemq-client

20 known vulnerabilities (2 critical, 3 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
6.4.0 (Oct 22, 2026): no advisory affects it
Newest unaffected release
6.4.0 (Oct 22, 2026), the latest release
Advisories
20 · 2 critical, 3 high, 2 medium, 1 low
Dependents
82
Releases
109 since 5.8.0 (Feb 6, 2013)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-50734
    Affects 5.8.0 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
  • CVE-2026-53917
    Affects 5.8.0 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
  • CVE-2026-39304
    Affects 5.8.0 to 5.19.3 (5.19.4 is outside it); 6.0.0 to 6.2.3 (6.2.4 is outside it)
  • CVE-2026-33227
    Affects 5.8.0 to 5.19.2 (5.19.3 is outside it); 6.0.0 to 6.2.1 (6.2.2 is outside it)
  • CVE-2025-27533
    Affects 5.8.0 to 5.16.7 (5.16.8 is outside it); 5.17.0 to 5.17.6 (5.17.7 is outside it); 5.18.0 to 5.18.6 (5.18.7 is outside it); 6.0.0 to 6.1.5 (6.1.6 is outside it)
  • CVE-2023-46604
    Affects 5.8.0 to 5.15.15 (5.15.16 is outside it); 5.16.0 to 5.16.6 (5.16.7 is outside it); 5.17.0 to 5.17.5 (5.17.6 is outside it); 5.18.0 to 5.18.2 (5.18.3 is outside it)
  • CVE-2015-7559
    Affects 5.8.0 to 5.14.4 (5.14.5 is outside it)
  • CVE-2019-0222
    Affects 5.8.0 to 5.15.8 (5.15.9 is outside it)
  • CVE-2018-11775
    Affects 5.8.0 to 5.15.5 (5.15.6 is outside it)
  • CVE-2016-6810
    Affects 5.8.0 to 5.14.1 (5.14.2 is outside it)
  • CVE-2014-3600
    Affects 5.8.0 to 5.10.0 (5.10.1 is outside it)
  • CVE-2016-0782
    Affects 5.8.0 to 5.11.3 (5.11.4 is outside it); 5.12.0 to 5.12.2 (5.12.3 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it)
Show all 20 advisoriesShow fewer advisories
  • CVE-2016-3088
    Affects 5.8.0 to 5.13.5 (5.14.0 is outside it)
  • CVE-2016-0734
    Affects 5.8.0 to 5.13.1 (5.13.2 is outside it)
  • CVE-2015-5254
    Affects 5.8.0 to 5.11.2 (5.11.3 is outside it); 5.12.0 to 5.12.1 (5.12.2 is outside it)
  • CVE-2015-1830
    Affects 5.8.0 to 5.11.1 (5.11.2 is outside it)
  • CVE-2014-3576
    Affects 5.8.0 to 5.10.2 (5.11.0 is outside it)
  • CVE-2014-8110
    Affects 5.8.0 to 5.10.0 (5.10.1 is outside it)
  • CVE-2013-1879
    Affects 5.8.0 (5.9.0 is outside it)
  • CVE-2013-3060
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 20

  • Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format…

    Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

    Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property…

    Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

    Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be…

    Affected: fixed in 5.19.4; from 6.0.0, fixed in 6.2.4; fixed in 5.19.4; from 6.0.0, fixed in 6.2.4.

    Fixed in 5.19.4 (released Mar 28, 2026, 13 days before disclosure) and 6.2.4 (released Apr 8, 2026, 2 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • CVE-2026-33227Medium 4.3

    Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a…

    Affected: fixed in 5.19.3; from 6.0.0, fixed in 6.2.2; fixed in 5.19.3; from 6.0.0, fixed in 6.2.2.

    Fixed in 5.19.3 (released Mar 20, 2026, 18 days before disclosure) and 6.2.2 (released Mar 20, 2026, 18 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • CVE-2025-27533Medium 6.9

    Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

    Affected: fixed in 5.16.8; from 5.17.0, fixed in 5.17.7; from 5.18.0, fixed in 5.18.7; from 6.0.0, fixed in 6.1.6.

    Fixed in 5.16.8 (released Mar 18, 2025, 50 days before disclosure), 5.17.7 (released Mar 14, 2025, 54 days before disclosure), 5.18.7 (released Mar 13, 2025, 55 days before disclosure) and 1 other version.

    The latest release, 6.4.0, is not affected.

  • CVE-2023-46604Critical 10.0 · KEV

    Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

    Affected: fixed in 5.15.16; from 5.16.0, fixed in 5.16.7; from 5.17.0, fixed in 5.17.6; from 5.18.0, fixed in 5.18.3.

    Fixed in 5.15.16 (released Oct 26, 2023, 1 day before disclosure), 5.16.7 (released Oct 25, 2023, 2 days before disclosure), 5.17.6 (released Oct 25, 2023, 2 days before disclosure) and 1 other version.

    The latest release, 6.4.0, is not affected.

  • It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class.

    Affected: fixed in 5.14.5.

    Fixed in 5.14.5 (released Apr 11, 2017, 842 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

    Affected: from 5.0.0, fixed in 5.15.9.

    Fixed in 5.15.9 (released Mar 15, 2019, 13 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM…

    Affected: fixed in 5.15.6.

    Fixed in 5.15.6 (released Sep 4, 2018, 6 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based…

    Affected: from 5.0.0, fixed in 5.14.2.

    Fixed in 5.14.2 (released Dec 5, 2016, 401 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via…

    Affected: from 5.0.0, fixed in 5.10.1.

    Fixed in 5.10.1 (released Jan 15, 2015, 1016 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote…

    Affected: from 5.0.0, fixed in 5.11.4; from 5.12.0, fixed in 5.12.3; from 5.13.0, fixed in 5.13.2.

    Fixed in 5.11.4 (released Feb 3, 2016, 184 days before disclosure), 5.12.3 (released Feb 3, 2016, 184 days before disclosure) and 5.13.2 (released Mar 1, 2016, 157 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • CVE-2016-3088Critical 9.8 · KEV

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTT

    Affected: from 5.0.0, fixed in 5.14.0.

    Fixed in 5.14.0 (released Aug 2, 2016, 62 days after disclosure).

    The latest release, 6.4.0, is not affected.

  • The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it…

    Affected: from 5.0.0, fixed in 5.13.2.

    Fixed in 5.13.2 (released Mar 1, 2016, 37 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to…

    Affected: from 5.0.0, fixed in 5.11.3; from 5.12.0, fixed in 5.12.2.

    Fixed in 5.11.3 (released Oct 29, 2015, 71 days before disclosure) and 5.12.2 (released Jan 5, 2016, 3 days before disclosure).

    The latest release, 6.4.0, is not affected.

Show all 20 advisoriesShow fewer advisories

  • Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2…

    Affected: from 5.0.0, fixed in 5.11.2.

    Fixed in 5.11.2 (released Aug 6, 2015, 13 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a…

    Affected: fixed in 5.11.0.

    Fixed in 5.11.0 (released Jan 30, 2015, 196 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow…

    Affected: from 5.0.0, fixed in 5.10.1.

    Fixed in 5.10.1 (released Jan 15, 2015, 28 days before disclosure).

    The latest release, 6.4.0, is not affected.

  • Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary…

    Affected: fixed in 5.9.0.

    Fixed in 5.9.0 (released Oct 14, 2013, 88 days after disclosure).

    The latest release, 6.4.0, is not affected.

  • The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive…

    Affected: fixed in 5.8.0.

    Fixed in 5.8.0 (released Feb 6, 2013, 74 days before disclosure).

    The latest release, 6.4.0, is not affected.