Apache Artemis (Apache Software Foundation) - vulnerabilities (CVEs)

9 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-10. Vendor: Apache Software Foundation.

CVEs of Apache Artemis

CVE-2026-49362 - CVSS 7.5 (high), 2026-09-10: An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential…
CVE-2026-49363 - CVSS 7.5 (high), 2026-09-10: An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to…
CVE-2026-49364 - CVSS 9.1 (critical), 2026-09-10: An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection…
CVE-2026-57822 - CVSS 6.5 (medium), 2026-09-10: When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to…
CVE-2026-57967 - CVSS 9.8 (critical), 2026-09-10: An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the…
CVE-2026-67593 - CVSS 9.1 (critical), 2026-09-10: A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection…
CVE-2026-75880 - CVSS 6.5 (medium), 2026-09-10: An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery…
CVE-2026-32642 - CVSS 4.3 (medium), 2026-03-24: Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to…
CVE-2026-27446 - CVSS 9.8 (critical), 2026-03-04: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use…