MavenPackage

org.apache.artemis:artemis-server

4 known vulnerabilities (2 critical, 2 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-49362High 7.5
Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
Affected: from 2.50.0, through 2.56.0.
Fixed in 2.57.0 (released Sep 9, 2026, 1 day before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.57.0, is not affected.
CVE-2026-49363High 7.5
Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
Affected: from 2.50.0, through 2.56.0.
Fixed in 2.57.0 (released Sep 9, 2026, 1 day before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.57.0, is not affected.
CVE-2026-49364Critical 9.1
Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to…
Affected: from 2.50.0, through 2.56.0.
Fixed in 2.57.0 (released Sep 9, 2026, 1 day before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.57.0, is not affected.
CVE-2026-27446Critical 9.3
Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
Affected: from 2.50.0, through 2.51.0; from 2.50.0, fixed in 2.52.0.
Fixed in 2.52.0 (released Mar 2, 2026, 2 days before disclosure).
The latest release, 2.57.0, is not affected.