Severity: important

Affected versions:

- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.8 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.7 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.8 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.7 - Apache ActiveMQ Stomp (org.apache.activemq:activemq-stomp) before 5.19.8 - Apache ActiveMQ Stomp (org.apache.activemq:activemq-stomp) 6.0.0 before 6.2.7

Description:

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.

An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Credit:

tonghuaroot (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-53916

Severity: important

Affected versions:

- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.8 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.7 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.8 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.7 - Apache ActiveMQ Stomp (org.apache.activemq:activemq-stomp) before 5.19.8 - Apache ActiveMQ Stomp (org.apache.activemq:activemq-stomp) 6.0.0 before 6.2.7

Description:

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.

A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Credit:

Youngjoon Kim (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-49432

Severity: moderate

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 5.14.0 before 5.19.7 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.6 - Apache ActiveMQ (org.apache.activemq:activemq-all) 5.14.0 before 5.19.7 - Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.6 - Apache ActiveMQ All (org.apache.activemq:apache-activemq) 5.14.0 before 5.19.7 - Apache ActiveMQ All (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.6

Description:

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Credit:

Basel Khaled (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-49270

Severity: moderate

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.7 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.6 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.7 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.7 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.6

Description:

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Credit:

Leon Johnson (github: lokerxx) (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-46605

Severity: important

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.7 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.6 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.7 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.7 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.6

Description:

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Non-parenthesized discovery wrappers such as masterslave:vm://...,... and static:vm://... incorrectly pass validation allowing bypass of fix in CVE-2026-34197.

Original description from CVE-2026-34197.

Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Credit:

lokerxx (finder)

References:

https://nvd.nist.gov/vuln/detail/CVE-2026-34197 https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-45505

Severity: important

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.7 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.6 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.7 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.7 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.6

Description:

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:), including BrokerService.addNetworkConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Credit:

pyn3rd (finder) uname (finder) 4ra1n (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-42588

Severity: important

Affected versions:

- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.5 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.6 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.5 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.6 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.5

Description:

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All.

An authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application. The attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file.

Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.

Credit:

jsjcw (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-41044

Severity: important

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.6 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.5 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.6 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.5 - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.5

Description:

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.

Credit:

Fatih Ersinadim (finder) gggggggga (finder)

References:

https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-40466

Severity: moderate

Affected versions:

- Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.4 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.4 - Apache ActiveMQ MQTT (org.apache.activemq:activemq-mqtt) 6.0.0 before 6.2.4

Description:

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.

This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Credit:

Adrien Bernard (finder)

References:

https://www.cve.org/CVERecord?id=CVE-2025-66168 https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-40046

Severity: important

Affected versions:

- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.4 - Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.4 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.4 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.4 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.4 - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.4 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.4

Description:

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-39304

Severity: important

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.3 - Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.4 - Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.3

Description:

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .

Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.

Credit:

Naveen Sunkavally (Horizon3.ai) (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-34197

Severity: low

Affected versions:

- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.3 - Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.2 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.3 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.2 - Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.3 - Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.2 - Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.3 - Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.2

Description:

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All.

In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.

Credit:

Dawei Wang (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-33227