https://seclists.org/oss-sec/2026/q2/25: CVE-2026-33227: Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ Web: Improper Limitation of a Pathname to a stricted Dictory
Published Apr 6, 2026
·Updated
Affected Software
4 affected components
maven/org.apache.activemq/activemq-client<5.19.3, >=6.0.0<6.2.2
maven/org.apache.activemq/activemq-broker<5.19.3, >=6.0.0<6.2.2
maven/org.apache.activemq/activemq-all<5.19.3, >=6.0.0<6.2.2
maven/org.apache.activemq/activemq-web<5.19.3, >=6.0.0<6.2.2
Frequently Asked Questions
1
What is the severity of CVE-2026-33227?
The severity of CVE-2026-33227 is classified as low.
2
Which versions are affected by CVE-2026-33227?
CVE-2026-33227 affects several versions of Apache ActiveMQ Client, ActiveMQ Broker, ActiveMQ, and ActiveMQ Web prior to specified versions.
3
How do I fix CVE-2026-33227?
To fix CVE-2026-33227, upgrade to the patched versions of the affected Apache ActiveMQ components.
4
What types of Apache ActiveMQ components are affected by CVE-2026-33227?
CVE-2026-33227 affects Apache ActiveMQ Client, ActiveMQ Broker, ActiveMQ, and ActiveMQ Web.
5
When was CVE-2026-33227 published?
CVE-2026-33227 was published on April 6, 2026.