Apache Software Foundation Apache ActiveMQ

• CVE-2026-34197 High 8.8 Exploited Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans 98.3%
• CVE-2023-46604 Critical 10.0 Exploited Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack 100.0%
• CVE-2026-108500 Unrated Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection 0.2%
• CVE-2026-108946 Unrated Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection 0.2%
• CVE-2026-111822 Unrated Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation 0.2%
• CVE-2026-111821 Unrated Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal 0.2%
• CVE-2026-108949 Medium 6.5 Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM 0.5%
• CVE-2026-74761 High 7.5 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId 0.6%
• CVE-2026-59878 High 7.5 Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS 0.8%
• CVE-2026-61487 Medium 6.5 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations 0.5%
• CVE-2026-49434 High 7.5 Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker 0.6%
• CVE-2026-49432 High 7.5 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service 0.8%
• CVE-2026-49877 High 8.1 Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console 0.5%
• CVE-2026-50734 High 7.5 Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation 0.7%
• CVE-2026-50750 High 7.5 Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 0.7%
• CVE-2026-52760 Medium 6.1 Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console 0.7%
• CVE-2026-53916 High 7.5 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec 0.7%
• CVE-2026-53917 High 7.5 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling 0.7%
• CVE-2026-54475 High 7.5 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover 0.6%
• CVE-2026-42253 Medium 6.1 Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties 1.0%
• CVE-2026-42588 High 8.1 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector 0.7%
• CVE-2026-45505 High 8.8 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass 0.6%
• CVE-2026-46605 Medium 4.3 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal 0.3%
• CVE-2026-49157 High 8.8 Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default 0.4%
• CVE-2026-49270 Medium 5.9 Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) 0.4%
• CVE-2026-41044 High 8.8 Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia 1.0%
• CVE-2026-41043 Medium 6.5 Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues 0.6%
• CVE-2026-40466 High 8.8 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI 4.8%
• CVE-2026-39304 High 7.5 Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM 0.9%
• CVE-2026-40046 High 7.5 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated 0.4%
• CVE-2026-33227 Medium 4.3 Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory 0.4%
• CVE-2025-66168 Medium 5.4 Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated 0.9%
• CVE-2025-27533 Medium 6.9 Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation 9.0%
• CVE-2024-32114 High 8.5 Apache ActiveMQ: Jolokia and REST API were not secured with default configuration 7.1%
• CVE-2022-41678 Unrated Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE 85.7%
• CVE-2021-26117 Unrated ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind 11.3%