Vigie VulnDBEuropean-hosted Vulnerability DB

Apache Software Foundation Apache ActiveMQ All

20 published vulnerabilities name this product.

As the CNAs write it in their CVE records (vendor and product); the versions are theirs.

CVEVulnerable versionsTitleSeverityPublishedEPSSExploitation
CVE-2026-747616.0.0 – < 6.3.2 ; < 5.19.11Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientIdHIGH 7.50.6 %
CVE-2026-59878< 5.19.9 ; 6.0.0 – < 6.2.8Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoSHIGH 7.50.8 %
CVE-2026-61487< 5.19.9 ; 6.0.0 – < 6.2.8Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinationsMEDIUM 6.50.5 %
CVE-2026-49434< 5.19.8 ; 6.0.0 – < 6.2.7Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties…HIGH 7.50.6 %
CVE-2026-49432< 5.19.8 ; 6.0.0 – < 6.2.7Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of serviceHIGH 7.50.8 %
CVE-2026-50734< 5.19.8 ; 6.0.0 – < 6.2.7Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negoti…HIGH 7.50.7 %
CVE-2026-507505.19.7 – < 5.19.8 ; 6.2.6 – < 6.2.7Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270HIGH 7.50.7 %
CVE-2026-53916< 5.19.8 ; 6.0.0 – < 6.2.7Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codecHIGH 7.50.7 %
CVE-2026-53917< 5.19.8 ; 6.0.0 – < 6.2.7Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property un…HIGH 7.50.7 %
CVE-2026-54475< 5.19.8 ; 6.0.0 – < 6.2.7Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeoverHIGH 7.50.6 %
CVE-2026-42588< 5.19.7 ; 6.0.0 – < 6.2.6Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnectorHIGH 8.10.7 %
CVE-2026-45505< 5.19.7 ; 6.0.0 – < 6.2.6Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper BypassHIGH 8.80.6 %
CVE-2026-46605< 5.19.7 ; 6.0.0 – < 6.2.6Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removalMEDIUM 4.30.3 %
CVE-2026-492705.14.0 – < 5.19.7 ; 6.0.0 – < 6.2.6Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)MEDIUM 5.90.4 %
CVE-2026-41044< 5.19.6 ; 6.0.0 – < 6.2.5Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jol…HIGH 8.81.0 %
CVE-2026-40466< 5.19.6 ; 6.0.0 – < 6.2.5Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URIHIGH 8.84.8 %
CVE-2026-39304< 5.19.4 ; 6.0.0 – < 6.2.4Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be expl…HIGH 7.50.9 %
CVE-2026-400466.0.0 – < 6.2.4Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is…HIGH 7.50.4 %
CVE-2026-33227< 5.19.3 ; 6.0.0 – < 6.2.2Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathn…MEDIUM 4.30.4 %
CVE-2026-34197< 5.19.4 ; 6.0.0 – < 6.2.3Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansHIGH 8.898 %KEV