Apache Activemq (Apache Software Foundation) - vulnerabilities (CVEs)

35 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-09. Vendor: Apache Software Foundation.

CVEs of Apache Activemq

CVE-2026-74761 - CVSS 7.5 (high), 2026-09-09: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can…
CVE-2026-59878 - CVSS 7.5 (high), 2026-07-28: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed…
CVE-2026-61487 - CVSS 6.5 (medium), 2026-07-28: Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a…
CVE-2026-49434 - CVSS 7.5 (high), 2026-06-30: Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify…
CVE-2026-49432 - CVSS 7.5 (high), 2026-06-30: Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an…
CVE-2026-49877 - CVSS 8.1 (high), 2026-06-30: Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web…
CVE-2026-50734 - CVSS 7.5 (high), 2026-06-30: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker…
CVE-2026-50750 - CVSS 7.5 (high), 2026-06-30: Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an…
CVE-2026-52760 - CVSS 6.1 (medium), 2026-06-30: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse…
CVE-2026-53916 - CVSS 7.5 (high), 2026-06-30: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens…
CVE-2026-53917 - CVSS 7.5 (high), 2026-06-30: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An…
CVE-2026-54475 - CVSS 7.5 (high), 2026-06-30: Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are…
CVE-2026-49157 - CVSS 8.8 (high), 2026-06-01: Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default…
CVE-2026-49270 - CVSS 5.9 (medium), 2026-06-01: Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers that are configured…
CVE-2026-42588 - CVSS 8.1 (high), 2026-06-01: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache…
CVE-2026-46605 - CVSS 4.3 (medium), 2026-06-01: Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with…
CVE-2026-45505 - CVSS 8.8 (high), 2026-06-01: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache…
CVE-2026-42253 - CVSS 6.1 (medium), 2026-06-01: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet…
CVE-2026-40466 - CVSS 8.8 (high), 2026-04-24: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache…
CVE-2026-41044 - CVSS 8.8 (high), 2026-04-24: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ…
CVE-2026-41043 - CVSS 6.5 (medium), 2026-04-24: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker…
CVE-2026-39304 - CVSS 7.5 (high), 2026-04-10: Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not…
CVE-2026-40046 - CVSS 7.5 (high), 2026-04-09: Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet…
CVE-2026-34197 - CVSS 8.8 (high), 2026-04-07: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ…
CVE-2026-33227 - CVSS 4.3 (medium), 2026-04-07: Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache…
CVE-2025-66168 - CVSS 8.8 (high), 2026-03-04: WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the following for more details:…
CVE-2025-27533 - CVSS 7.5 (high), 2025-05-07: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not…
CVE-2024-32114 - CVSS 8.8 (high), 2024-05-02: In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It…
CVE-2022-41678 - CVSS 8.8 (high), 2023-11-28: Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows…
CVE-2023-46604 - CVSS 10 (critical), 2023-10-27: The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a…
CVE-2021-26117 - CVSS 7.5 (high), 2021-01-27: The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to…
CVE-2018-8006 - CVSS 6.1 (medium), 2018-10-10: An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache…
CVE-2018-11775 - CVSS 7.4 (high), 2018-09-10: TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a…
CVE-2017-15709 - CVSS 3.7 (low), 2018-02-13: When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are…
CVE-2016-6810 - CVSS 6.1 (medium), 2018-01-10: In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration…