UBUNTU-CVE-2026-108500: Input Validation

Published Nov 5, 2026

Updated

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups. This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

Affected Software

7 affected components

ubuntu/activemq*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 6.4.0

Event History

Nov 5, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments of Apache ActiveMQ that use the LDAPAuthorizationMapPlugin are affected if they run versions 6.3.0 through before 6.3.3, or 5.19.0 through before 5.19.12.

What access does an attacker need?

An attacker must be authenticated and able to create or address a destination with a crafted name containing LDAP distinguished-name special characters, such as commas, plus signs, equals signs, or backslashes.

What is the recommended remediation?

Upgrade Apache ActiveMQ to version 6.4.0, 6.3.3, or 5.19.12. These versions fix the LDAP search-base manipulation issue.

UBUNTU-CVE-2026-108500: Input Validation

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What is the recommended remediation?