MavenPackage

org.apache.activemq:apache-activemq

31 known vulnerabilities (18 high, 9 medium), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 31 · 18 high, 9 medium

Dependents: 4
Registry: Maven Central

Advisories 31

CVE-2026-108946Unrated
Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
Affected: from 6.0.0, fixed in 6.3.3; fixed in 5.19.12.
CVE-2026-111822Unrated
Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Affected: from 6.0.0, fixed in 6.3.3; fixed in 5.19.12.
CVE-2026-111821Unrated
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Affected: from 6.0.0, fixed in 6.3.3; fixed in 5.19.12.
CVE-2026-74761High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
Affected: from 6.0.0, fixed in 6.3.2; fixed in 5.19.11.
CVE-2026-59878High 7.5
Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS
Affected: fixed in 5.19.9; from 6.0.0, fixed in 6.2.8.
CVE-2026-61487Medium 6.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations
Affected: fixed in 5.19.9; from 6.0.0, fixed in 6.2.8.
CVE-2026-49434High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties…
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
CVE-2026-49432High 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
CVE-2026-49877High 8.1
Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
CVE-2026-50734High 7.5
Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format…
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
CVE-2026-50750High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270
Affected: from 5.19.7, fixed in 5.19.8; from 6.2.6, fixed in 6.2.7; from 5.19.7, fixed in 5.19.8; from 6.2.6, fixed in 6.2.7.
CVE-2026-52760Medium 6.1
Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
CVE-2026-53916High 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
CVE-2026-53917High 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property…
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
CVE-2026-54475High 7.5
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

Show all 31 advisoriesShow fewer advisories

CVE-2026-42253Medium 6.1
Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
CVE-2026-42588High 8.1
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
CVE-2026-45505High 8.8
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
CVE-2026-46605Medium 4.3
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
CVE-2026-49157High 8.8
Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
CVE-2026-49270Medium 5.9
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)
Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.
CVE-2026-41044High 8.8
Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by…
Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5; fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.
CVE-2026-41043Medium 6.5
Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues
Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5; fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.
CVE-2026-40466High 8.8
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5; fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.
CVE-2026-39304High 7.5
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be…
Affected: fixed in 5.19.4; from 6.0.0, fixed in 6.2.4; fixed in 5.19.4; from 6.0.0, fixed in 6.2.4.
CVE-2026-40046High 7.5
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is…
Affected: from 6.0.0, fixed in 6.2.4; from 6.0.0, fixed in 6.2.4.
CVE-2026-33227Medium 4.3
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a…
Affected: fixed in 5.19.3; from 6.0.0, fixed in 6.2.2.
CVE-2025-66168Medium 5.4
Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly…
Affected: fixed in 5.19.2; from 6.0.0, fixed in 6.1.9; from 6.2.0, fixed in 6.2.1; fixed in 5.19.2; from 6.0.0, fixed in 6.1.9; from 6.2.0, fixed in 6.2.1.
CVE-2024-32114High 8.5
Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
Affected: from 6.0.0, fixed in 6.1.2.
CVE-2022-41678Medium
Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE
Affected: fixed in 5.16.6; from 5.17.0, fixed in 5.17.4; fixed in 5.16.6; from 5.17.0, fixed in 5.17.4.
CVE-2012-6551Unrated
The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a…
Affected: fixed in 5.8.0.