Artemis (Apache) - vulnerabilities (CVEs)

22 CVEs, 0 in the last 30 days, 78 known versions, newest CVE from 2026-09-10. Vendor: Apache.

CVEs of Artemis

CVE-2026-49362 - CVSS 7.5 (high), 2026-09-10: An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential…
CVE-2026-49363 - CVSS 7.5 (high), 2026-09-10: An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to…
CVE-2026-49364 - CVSS 9.1 (critical), 2026-09-10: An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection…
CVE-2026-57822 - CVSS 6.5 (medium), 2026-09-10: When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to…
CVE-2026-57967 - CVSS 9.8 (critical), 2026-09-10: An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the…
CVE-2026-67593 - CVSS 9.1 (critical), 2026-09-10: A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection…
CVE-2026-75880 - CVSS 6.5 (medium), 2026-09-10: An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery…
CVE-2026-40914 - CVSS 4.3 (medium), 2026-05-28: A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send…
CVE-2026-32642 - CVSS 4.3 (medium), 2026-03-24: Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to…
CVE-2026-27446 - CVSS 9.8 (critical), 2026-03-04: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use…
CVE-2025-27391 - CVSS 6.8 (medium), 2025-04-09: Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the…
CVE-2025-27427 - CVSS 4.3 (medium), 2025-04-01: A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the…
CVE-2023-50780 - CVSS 8.8 (high), 2024-10-14: Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia…
CVE-2021-4040 - CVSS 5.3 (medium), 2022-08-24: A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw…
CVE-2022-35278 - CVSS 6.1 (medium), 2022-08-23: In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML…
CVE-2022-23913 - CVSS 7.5 (high), 2022-02-04: In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of…
CVE-2021-26117 - CVSS 7.5 (high), 2021-01-27: The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to…
CVE-2021-26118 - CVSS 7.5 (high), 2021-01-27: While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed…
CVE-2020-13932 - CVSS 6.1 (medium), 2020-07-20: In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this…
CVE-2020-10727 - CVSS 5.5 (medium), 2020-06-26: A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the…
CVE-2017-12174 - CVSS 7.5 (high), 2018-03-07: It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an…
CVE-2016-4978 - CVSS 7.2 (high), 2016-09-27: The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ…