CVE-2026-108946 is an improper input validation vulnerability in Apache ActiveMQ and Apache ActiveMQ KahaDB that allows an authenticated client to spoof another user's connection, session, and consumer IDs. This flaw enables unauthorized consumption from another user's temporary queue or topic, disruption of live subscriptions by tearing them down, and permanent deletion of in-flight, unacknowledged messages through forged acknowledgments. The issue affects Apache ActiveMQ versions from 6.0.0 up to but not including 6.3.3, and versions before 5.19.12. Upgrading to versions 6.3.3, 6.4.0, or 5.19.12 resolves the vulnerability.
CVE-2026-111822 is a vulnerability in Apache ActiveMQ related to improper invalidation of cached authorizations. After a runtime configuration change removes a principal's write permission on a destination, existing authenticated connections opened before the change can continue sending messages to that destination. New connections and explicit producers are correctly denied. The issue affects Apache ActiveMQ versions from 6.0.0 up to but not including 6.3.3, and versions before 5.19.12. The vulnerability is fixed in versions 6.3.3 and 5.19.12.
CVE-2026-111821 is an improper input validation vulnerability in Apache ActiveMQ and its KahaDB storage. It allows a user to create a durable subscription with a combined clientId and subscription name length exceeding 65,535 characters, which can cause the broker to shut down and become unrecoverable. This affects Apache ActiveMQ versions from 6.0.0 up to but not including 6.3.3, and versions before 5.19.12. The issue is fixed in versions 6.3.3 and 5.19.12.
CVE-2026-74761 is an improper input validation vulnerability in the TopicRegion component of Apache ActiveMQ Broker. An authenticated client can spoof the clientId when removing a durable topic subscription, potentially impacting the integrity of subscription management. This affects Apache ActiveMQ Broker versions before 5.19.11 and versions from 6.0.0 before 6.3.2. Upgrading to versions 5.19.11 or 6.3.2 resolves the issue.
Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All.
A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done rapidly enough can lead to exhaustion of the NIO thread pool denying service to other connections.
This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8.
Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which fixes the issue.
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated low-privilege user can bypass a per-destination
write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a
comma-separated composite of real queues. This allows publishing messages to any of the destinations in the list without proper write ACL permissions because the authorization check is bypassed due to the composite destination being marked as temporary.
This issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8.
Users are recommended to upgrade to version 5.19.9, 6.2.8 or 6.3.0, which fixes the issue.
Apache ActiveMQ Broker versions before 5.19.8 and from 6.0.0 before 6.2.7 contain a missing authorization vulnerability. Temporary destinations, which should be isolated to the connection that created them, can be accessed by other connections due to insufficient server-side enforcement. This allows unauthorized consumption from temporary destinations belonging to other connections. The issue is fixed in versions 5.19.8 and 6.2.7.
A vulnerability in Apache ActiveMQ allows an authenticated user to cause a denial of service (DoS) by sending a crafted OpenWire message with an excessively large encoded size value. This triggers an out-of-memory (OOM) condition and crashes the broker. The issue affects multiple Apache ActiveMQ components before versions 5.19.8 and from 6.0.0 before 6.2.7. Upgrading to versions 5.19.8 or 6.2.7 resolves the issue.
Apache ActiveMQ Client and Apache ActiveMQ contain a vulnerability where an unauthenticated network attacker can cause a denial of service (DoS) by sending a crafted WireFormatInfo frame with a maliciously large size value. This triggers an out-of-memory (OOM) condition during pre-authentication negotiation, crashing the broker. Versions before 5.19.8 and from 6.0.0 before 6.2.7 are affected. The issue is fixed in versions 5.19.8 and 6.2.7.
Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM.
This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Improper Authorization vulnerability in Apache ActiveMQ.
An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM.
This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.
Users are recommended to upgrade to version 6.2.7, which fixes the issue.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.
The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.