Apache ActiveMQ vulnerabilities

25 known vulnerabilities in Apache ActiveMQ from Apache. 25 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Apache ActiveMQ: Missing Authentication for Critical Functionality

  CVE-2026-111822Nov 4, 2026Apache

  Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can

• 7.5 High severity

  Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.

  CVE-2026-111821Nov 4, 2026Apache

  Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB wh

• 7.5 High severity

  Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and…

  CVE-2026-74761Sep 9, 2026Apache

  Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects Apache ActiveMQ Broker: bef

• 7.5 High severity

  Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache…

  CVE-2026-59878Jul 28, 2026Apache

  Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause t

• 7.5 High severity

  Apache ActiveMQ Broker: Missing Authorization

  CVE-2026-54475Jun 30, 2026Apache

  Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only che

• 7.5 High severity

  Apache ActiveMQ: Memory Allocation with Excessive Size Value

  CVE-2026-53917Jun 30, 2026Apache

  Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size valu

• 7.5 High severity

  Apache ActiveMQ: Memory Allocation with Excessive Size Value

  CVE-2026-53916Jun 30, 2026Apache

  Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them

• 7.5 High severity

  Apache ActiveMQ Broker: Uncontrolled Resource Consumption

  CVE-2026-50750Jun 30, 2026Apache

  Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without send

• 7.5 High severity

  Apache ActiveMQ Client: Memory Allocation with Excessive Size Value

  CVE-2026-50734Jun 30, 2026Apache

  Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. T

• 8.1 High severity

  Apache ActiveMQ: Improper Authorization

  CVE-2026-49877Jun 30, 2026Apache

  Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affect

• 7.5 High severity

  Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache…

  CVE-2026-49434Jun 30, 2026Apache

  Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports in

• 7.5 High severity

  Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache…

  CVE-2026-49432Jun 30, 2026Apache

  Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the

• 8.8 High severity

  Apache ActiveMQ: Incorrect Default Permissions

  CVE-2026-49157Jun 1, 2026Apache

  Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operat

• 8.8 High severity

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…

  CVE-2026-45505Jun 1, 2026Apache

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` in

• 8.1 High severity

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…

  CVE-2026-42588Jun 1, 2026Apache

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console.

• 7.2 High severity

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…

  CVE-2026-41044Apr 24, 2026Apache

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker nam

• 8.8 High severity

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…

  CVE-2026-40466Apr 24, 2026ApacheEPSS 4.78%

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HT

• 7.5 High severity

  Apache ActiveMQ Client: Uncontrolled Resource Consumption

  CVE-2026-39304Apr 10, 2026Apache

  Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to

• 7.5 High severity

  Apache ActiveMQ: Integer Overflow or Wraparound

  CVE-2026-40046Apr 9, 2026Apache

  Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releas

• 8.8 High severity

  Apache ActiveMQ Improper Input Validation Exploited

  CVE-2026-34197Apr 7, 2026ApacheEPSS 98.3%

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia

• 8.8 High severity

  Apache ActiveMQ: Integer Overflow or Wraparound

  CVE-2025-66168Mar 4, 2026Apache

  WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=CVE

• 7.5 High severity

  Apache ActiveMQ: Memory Allocation with Excessive Size Value

  CVE-2025-27533May 7, 2025ApacheEPSS 9.11%

  Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of s

• 8.8 High severity

  Apache ActiveMQ: Initialization of a Resource with an Insecure Default

  CVE-2024-32114May 2, 2024ApacheEPSS 7.15%

  In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can i

• 8.8 High severity

  Apache ActiveMQ: Improper Authentication

  CVE-2022-41678Nov 28, 2023ApacheEPSS 85.7%

  Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostR

• 9.8 Critical severity

  Apache ActiveMQ Deserialization of Untrusted Data Exploited

  CVE-2023-46604Oct 27, 2023ApacheEPSS 100%

  The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class t