# org.apache.activemq:apache-activemq (Maven) vulnerabilities

31 known vulnerabilities (18 high, 9 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Dependents: 4
- Registry: https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq

## Advisories (31)

### [CVE-2026-108946](https://cve.now/CVE-2026-108946): Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection

- Severity: Unrated
- Published: Nov 4, 2026
- Affected: from 6.0.0, fixed in 6.3.3; fixed in 5.19.12.

### [CVE-2026-111822](https://cve.now/CVE-2026-111822): Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation

- Severity: Unrated
- Published: Nov 4, 2026
- Affected: from 6.0.0, fixed in 6.3.3; fixed in 5.19.12.

### [CVE-2026-111821](https://cve.now/CVE-2026-111821): Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal

- Severity: Unrated
- Published: Nov 4, 2026
- Affected: from 6.0.0, fixed in 6.3.3; fixed in 5.19.12.

### [CVE-2026-74761](https://cve.now/CVE-2026-74761): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

- Severity: High 7.5
- Published: Sep 9, 2026
- Affected: from 6.0.0, fixed in 6.3.2; fixed in 5.19.11.

### [CVE-2026-59878](https://cve.now/CVE-2026-59878): Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS

- Severity: High 7.5
- Published: Jul 28, 2026
- Affected: fixed in 5.19.9; from 6.0.0, fixed in 6.2.8.

### [CVE-2026-61487](https://cve.now/CVE-2026-61487): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations

- Severity: Medium 6.5
- Published: Jul 28, 2026
- Affected: fixed in 5.19.9; from 6.0.0, fixed in 6.2.8.

### [CVE-2026-49434](https://cve.now/CVE-2026-49434): Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties…

- Severity: High 7.5
- Published: Jun 30, 2026
- Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

### [CVE-2026-49432](https://cve.now/CVE-2026-49432): Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service

- Severity: High 7.5
- Published: Jun 30, 2026
- Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

### [CVE-2026-49877](https://cve.now/CVE-2026-49877): Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console

- Severity: High 8.1
- Published: Jun 30, 2026
- Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

### [CVE-2026-50734](https://cve.now/CVE-2026-50734): Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format…

- Severity: High 7.5
- Published: Jun 30, 2026
- Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

### [CVE-2026-50750](https://cve.now/CVE-2026-50750): Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270

- Severity: High 7.5
- Published: Jun 30, 2026
- Affected: from 5.19.7, fixed in 5.19.8; from 6.2.6, fixed in 6.2.7; from 5.19.7, fixed in 5.19.8; from 6.2.6, fixed in 6.2.7.

### [CVE-2026-52760](https://cve.now/CVE-2026-52760): Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console

- Severity: Medium 6.1
- Published: Jun 30, 2026
- Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

### [CVE-2026-53916](https://cve.now/CVE-2026-53916): Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec

- Severity: High 7.5
- Published: Jun 30, 2026
- Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

### [CVE-2026-53917](https://cve.now/CVE-2026-53917): Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property…

- Severity: High 7.5
- Published: Jun 30, 2026
- Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

### [CVE-2026-54475](https://cve.now/CVE-2026-54475): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover

- Severity: High 7.5
- Published: Jun 30, 2026
- Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7; fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.

### [CVE-2026-42253](https://cve.now/CVE-2026-42253): Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties

- Severity: Medium 6.1
- Published: Jun 1, 2026
- Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.

### [CVE-2026-42588](https://cve.now/CVE-2026-42588): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

- Severity: High 8.1
- Published: Jun 1, 2026
- Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.

### [CVE-2026-45505](https://cve.now/CVE-2026-45505): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia \`addNetworkConnector\` Discovery Wrapper Bypass

- Severity: High 8.8
- Published: Jun 1, 2026
- Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.

### [CVE-2026-46605](https://cve.now/CVE-2026-46605): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

- Severity: Medium 4.3
- Published: Jun 1, 2026
- Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.

### [CVE-2026-49157](https://cve.now/CVE-2026-49157): Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default

- Severity: High 8.8
- Published: Jun 1, 2026
- Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6; fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.

### [CVE-2026-49270](https://cve.now/CVE-2026-49270): Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)

- Severity: Medium 5.9
- Published: Jun 1, 2026
- Affected: fixed in 5.19.7; from 6.0.0, fixed in 6.2.6.

### [CVE-2026-41044](https://cve.now/CVE-2026-41044): Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by…

- Severity: High 8.8
- Published: Apr 24, 2026
- Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5; fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.

### [CVE-2026-41043](https://cve.now/CVE-2026-41043): Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues

- Severity: Medium 6.5
- Published: Apr 24, 2026
- Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5; fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.

### [CVE-2026-40466](https://cve.now/CVE-2026-40466): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI

- Severity: High 8.8
- Published: Apr 24, 2026
- Affected: fixed in 5.19.6; from 6.0.0, fixed in 6.2.5; fixed in 5.19.6; from 6.0.0, fixed in 6.2.5.

### [CVE-2026-39304](https://cve.now/CVE-2026-39304): Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be…

- Severity: High 7.5
- Published: Apr 10, 2026
- Affected: fixed in 5.19.4; from 6.0.0, fixed in 6.2.4; fixed in 5.19.4; from 6.0.0, fixed in 6.2.4.

### [CVE-2026-40046](https://cve.now/CVE-2026-40046): Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is…

- Severity: High 7.5
- Published: Apr 9, 2026
- Affected: from 6.0.0, fixed in 6.2.4; from 6.0.0, fixed in 6.2.4.

### [CVE-2026-33227](https://cve.now/CVE-2026-33227): Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a…

- Severity: Medium 4.3
- Published: Apr 7, 2026
- Affected: fixed in 5.19.3; from 6.0.0, fixed in 6.2.2.

### [CVE-2025-66168](https://cve.now/CVE-2025-66168): Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly…

- Severity: Medium 5.4
- Published: Mar 4, 2026
- Affected: fixed in 5.19.2; from 6.0.0, fixed in 6.1.9; from 6.2.0, fixed in 6.2.1; fixed in 5.19.2; from 6.0.0, fixed in 6.1.9; from 6.2.0, fixed in 6.2.1.

### [CVE-2024-32114](https://cve.now/CVE-2024-32114): Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

- Severity: High 8.5
- Published: May 2, 2024
- Affected: from 6.0.0, fixed in 6.1.2.

### [CVE-2022-41678](https://cve.now/CVE-2022-41678): Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

- Severity: Medium
- Published: Nov 28, 2023
- Affected: fixed in 5.16.6; from 5.17.0, fixed in 5.17.4; fixed in 5.16.6; from 5.17.0, fixed in 5.17.4.

### [CVE-2012-6551](https://cve.now/CVE-2012-6551): The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a…

- Severity: Unrated
- Published: Apr 21, 2013
- Affected: fixed in 5.8.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.activemq:apache-activemq
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.