Apache Software Foundation Apache ActiveMQ All
20 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-74761 | 6.0.0 – < 6.3.2 ; < 5.19.11 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59878 | < 5.19.9 ; 6.0.0 – < 6.2.8 | Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS | HIGH 7.5 | 0.8 % | ||
| CVE-2026-61487 | < 5.19.9 ; 6.0.0 – < 6.2.8 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-49434 | < 5.19.8 ; 6.0.0 – < 6.2.7 | Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties… | HIGH 7.5 | 0.6 % | ||
| CVE-2026-49432 | < 5.19.8 ; 6.0.0 – < 6.2.7 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service | HIGH 7.5 | 0.8 % | ||
| CVE-2026-50734 | < 5.19.8 ; 6.0.0 – < 6.2.7 | Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negoti… | HIGH 7.5 | 0.7 % | ||
| CVE-2026-50750 | 5.19.7 – < 5.19.8 ; 6.2.6 – < 6.2.7 | Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 | HIGH 7.5 | 0.7 % | ||
| CVE-2026-53916 | < 5.19.8 ; 6.0.0 – < 6.2.7 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec | HIGH 7.5 | 0.7 % | ||
| CVE-2026-53917 | < 5.19.8 ; 6.0.0 – < 6.2.7 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property un… | HIGH 7.5 | 0.7 % | ||
| CVE-2026-54475 | < 5.19.8 ; 6.0.0 – < 6.2.7 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover | HIGH 7.5 | 0.6 % | ||
| CVE-2026-42588 | < 5.19.7 ; 6.0.0 – < 6.2.6 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector | HIGH 8.1 | 0.7 % | ||
| CVE-2026-45505 | < 5.19.7 ; 6.0.0 – < 6.2.6 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass | HIGH 8.8 | 0.6 % | ||
| CVE-2026-46605 | < 5.19.7 ; 6.0.0 – < 6.2.6 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-49270 | 5.14.0 – < 5.19.7 ; 6.0.0 – < 6.2.6 | Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-41044 | < 5.19.6 ; 6.0.0 – < 6.2.5 | Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jol… | HIGH 8.8 | 1.0 % | ||
| CVE-2026-40466 | < 5.19.6 ; 6.0.0 – < 6.2.5 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI | HIGH 8.8 | 4.8 % | ||
| CVE-2026-39304 | < 5.19.4 ; 6.0.0 – < 6.2.4 | Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be expl… | HIGH 7.5 | 0.9 % | ||
| CVE-2026-40046 | 6.0.0 – < 6.2.4 | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is… | HIGH 7.5 | 0.4 % | ||
| CVE-2026-33227 | < 5.19.3 ; 6.0.0 – < 6.2.2 | Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathn… | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-34197 | < 5.19.4 ; 6.0.0 – < 6.2.3 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans | HIGH 8.8 | 98 % | KEV |