Red Hat AMQ Broker 7.13.1 addresses multiple security vulnerabilities including CVE-2025-1948, a Jetty HTTP/2 header list size vulnerability; CVE-2025-48734, where Apache Commons BeanUtils PropertyUtilsBean does not suppress an enum's declaredClass property by default; and CVE-2025-49146, involving insecure authentication in PostgreSQL JDBC channel binding. These issues potentially affect message handling, property suppression in Java beans, and authentication security within the broker environment. The advisory recommends updating to version 7.13.1 to mitigate these vulnerabilities. The update also includes bug fixes unrelated to security.

The vulnerabilities fixed in Red Hat AMQ Broker 7.13.1 could allow attackers to exploit HTTP/2 header size limitations, improperly access or manipulate Java enum properties, or bypass secure authentication in PostgreSQL JDBC connections. These issues may lead to denial of service, unauthorized access, or authentication weaknesses within the messaging broker environment. The advisory rates the security impact as Important (high), but no known exploits in the wild have been reported at this time.

Red Hat has released version 7.13.1 of AMQ Broker containing official fixes for the identified vulnerabilities. Users should back up their existing installations and apply the 7.13.1 update from the Red Hat Customer Portal to remediate these issues. No alternative mitigations or workarounds are specified. Patch status is confirmed by the vendor advisory.