Severity: important

Affected versions:

- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.4 - Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.4 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.4 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.4 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.4 - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.4 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.4

Description:

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-39304

Severity: moderate

Affected versions:

- Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.4 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.4 - Apache ActiveMQ MQTT (org.apache.activemq:activemq-mqtt) 6.0.0 before 6.2.4

Description:

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.

This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Credit:

Adrien Bernard (finder)

References:

https://www.cve.org/CVERecord?id=CVE-2025-66168 https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-40046

Severity: important

Affected versions:

- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.5 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.6 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.5 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.6 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.5

Description:

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All.

An authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application. The attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file.

Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.

Credit:

jsjcw (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-41044

Severity: important

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.6 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.5 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.6 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.5 - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.5

Description:

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.

Credit:

Fatih Ersinadim (finder) gggggggga (finder)

References:

https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-40466

Severity: important

Affected versions:

- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.5 - Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.6 - Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.5

Description:

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.

This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.

Credit:

Khaled Alshammri (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-41043

Severity: moderate

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.7 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.6 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.7 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.7 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.6

Description:

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Credit:

Leon Johnson (github: lokerxx) (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-46605

Severity: important

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.7 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.6 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.7 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.7 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.6

Description:

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Non-parenthesized discovery wrappers such as masterslave:vm://...,... and static:vm://... incorrectly pass validation allowing bypass of fix in CVE-2026-34197.

Original description from CVE-2026-34197.

Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Credit:

lokerxx (finder)

References:

https://nvd.nist.gov/vuln/detail/CVE-2026-34197 https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-45505

Severity: moderate

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 5.14.0 before 5.19.7 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.6 - Apache ActiveMQ (org.apache.activemq:activemq-all) 5.14.0 before 5.19.7 - Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.6 - Apache ActiveMQ All (org.apache.activemq:apache-activemq) 5.14.0 before 5.19.7 - Apache ActiveMQ All (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.6

Description:

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Credit:

Basel Khaled (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-49270

Severity: important

Affected versions:

- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.7 - Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.6 - Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.7 - Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.6 - Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.7 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.6

Description:

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:), including BrokerService.addNetworkConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Credit:

pyn3rd (finder) uname (finder) 4ra1n (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-42588

Severity: important

Affected versions:

- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.7 - Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.6 - Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.7 - Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.6

Description:

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.

Credit:

Vishal Shukla (finder) pyn3rd (finder) uname (finder) 4ra1n (finder)

References:

https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-42253