Activemq (Apache) - vulnerabilities (CVEs)

75 CVEs, 0 in the last 30 days, 141 known versions, newest CVE from 2026-09-09. Vendor: Apache.

CVEs of Activemq

CVE-2026-74761 - CVSS 7.5 (high), 2026-09-09: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can…
CVE-2026-59878 - CVSS 7.5 (high), 2026-07-28: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed…
CVE-2026-61487 - CVSS 6.5 (medium), 2026-07-28: Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a…
CVE-2026-49434 - CVSS 7.5 (high), 2026-06-30: Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify…
CVE-2026-49432 - CVSS 7.5 (high), 2026-06-30: Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an…
CVE-2026-49877 - CVSS 8.1 (high), 2026-06-30: Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web…
CVE-2026-50734 - CVSS 7.5 (high), 2026-06-30: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker…
CVE-2026-50750 - CVSS 7.5 (high), 2026-06-30: Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an…
CVE-2026-52760 - CVSS 6.1 (medium), 2026-06-30: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse…
CVE-2026-53916 - CVSS 7.5 (high), 2026-06-30: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens…
CVE-2026-53917 - CVSS 7.5 (high), 2026-06-30: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An…
CVE-2026-54475 - CVSS 7.5 (high), 2026-06-30: Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are…
CVE-2026-49157 - CVSS 8.8 (high), 2026-06-01: Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default…
CVE-2026-49270 - CVSS 5.9 (medium), 2026-06-01: Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers that are configured…
CVE-2026-46605 - CVSS 4.3 (medium), 2026-06-01: Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with…
CVE-2026-45505 - CVSS 8.8 (high), 2026-06-01: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache…
CVE-2026-42588 - CVSS 8.1 (high), 2026-06-01: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache…
CVE-2026-42253 - CVSS 6.1 (medium), 2026-06-01: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet…
CVE-2026-40466 - CVSS 8.8 (high), 2026-04-24: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache…
CVE-2026-41044 - CVSS 8.8 (high), 2026-04-24: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ…
CVE-2026-41043 - CVSS 6.5 (medium), 2026-04-24: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker…
CVE-2026-39304 - CVSS 7.5 (high), 2026-04-10: Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not…
CVE-2026-33227 - CVSS 4.3 (medium), 2026-04-07: Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache…
CVE-2026-34197 - CVSS 8.8 (high), 2026-04-07: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ…
CVE-2025-66168 - CVSS 8.8 (high), 2026-03-04: WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the following for more details:…
CVE-2025-27533 - CVSS 7.5 (high), 2025-05-07: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not…
CVE-2024-32114 - CVSS 8.8 (high), 2024-05-02: In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It…
CVE-2022-41678 - CVSS 8.8 (high), 2023-11-28: Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows…
CVE-2023-46604 - CVSS 10 (critical), 2023-10-27: The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a…
CVE-2021-21351 - CVSS 9.1 (critical), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker…
CVE-2021-21347 - CVSS 9.8 (critical), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote…
CVE-2021-21350 - CVSS 9.8 (critical), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote…
CVE-2021-21349 - CVSS 8.6 (high), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote…
CVE-2021-21348 - CVSS 7.5 (high), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote…
CVE-2021-21341 - CVSS 7.5 (high), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote…
CVE-2021-21344 - CVSS 9.8 (critical), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote…
CVE-2021-21343 - CVSS 7.5 (high), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at…
CVE-2021-21346 - CVSS 9.8 (critical), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote…
CVE-2021-21342 - CVSS 9.1 (critical), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at…
CVE-2021-21345 - CVSS 9.9 (critical), 2021-03-23: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote…
CVE-2020-13947 - CVSS 6.1 (medium), 2021-02-08: An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache…
CVE-2021-26117 - CVSS 7.5 (high), 2021-01-27: The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to…
CVE-2020-26217 - CVSS 8.8 (high), 2020-11-16: XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by…
CVE-2020-13920 - CVSS 5.9 (medium), 2020-09-10: Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to…
CVE-2020-11998 - CVSS 9.8 (critical), 2020-09-10: A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that…
CVE-2020-1941 - CVSS 6.1 (medium), 2020-05-14: In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
CVE-2015-7559 - CVSS 2.7 (low), 2019-08-01: It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a…
CVE-2019-0201 - CVSS 5.9 (medium), 2019-05-23: An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when…
CVE-2013-7285 - CVSS 9.8 (critical), 2019-05-15: Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell…
CVE-2019-10241 - CVSS 6.1 (medium), 2019-04-22: In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a…
CVE-2019-0222 - CVSS 7.5 (high), 2019-03-28: In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
CVE-2018-8006 - CVSS 6.1 (medium), 2018-10-10: An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache…
CVE-2018-11775 - CVSS 7.4 (high), 2018-09-10: TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a…
CVE-2017-15709 - CVSS 3.7 (low), 2018-02-13: When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are…
CVE-2016-6810 - CVSS 6.1 (medium), 2018-01-10: In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration…
CVE-2014-3600 - CVSS 9.8 (critical), 2017-10-27: XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath…
CVE-2016-0782 - CVSS 5.4 (medium), 2016-08-05: The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to…
CVE-2016-3088 - CVSS 9.8 (critical), 2016-06-01: The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by…
CVE-2016-0734 - CVSS 6.1 (medium), 2016-04-07: The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote…
CVE-2015-5254 - CVSS 9.8 (critical), 2016-01-08: Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code…
CVE-2015-6524 - CVSS 5 (medium), 2015-08-24: The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators…
CVE-2014-3612 - CVSS 7.5 (high), 2015-08-24: The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to…
CVE-2015-1830 - CVSS 5 (medium), 2015-08-19: Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows…
CVE-2014-3576 - CVSS 7.5 (high), 2015-08-14: The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service…
CVE-2014-8110 - CVSS 4.3 (medium), 2015-02-12: Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to…
CVE-2013-1880 - CVSS 4.3 (medium), 2014-02-05: Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote…
CVE-2013-1879 - CVSS 4.3 (medium), 2013-07-20: Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML…
CVE-2012-6092 - CVSS 4.3 (medium), 2013-04-21: Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or…
CVE-2013-3060 - CVSS 6.4 (medium), 2013-04-21: The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a…
CVE-2012-6551 - CVSS 5 (medium), 2013-04-21: The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker…
CVE-2012-5784 - CVSS 5.8 (medium), 2012-11-04: Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation…
CVE-2011-4905 - CVSS 5 (medium), 2012-01-05: Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many…
CVE-2010-1587 - CVSS 5 (medium), 2010-04-28: The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash)…
CVE-2010-1244 - CVSS 6.8 (medium), 2010-04-05: Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the…
CVE-2010-0684 - CVSS 3.5 (low), 2010-04-05: Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web…