Apache ActiveMQ

Related CVEsby mentions

• CVE-2026-579679.8<1%
  Unauthenticated Session Hijack in Apache ActiveMQ Artemis CORE Protocol
  CVE-2026-57967 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache Artemis and Apache ActiveMQ Artemis message brokers. An unauthenticated remote attacker who can reach the broker's CORE acceptor can send a crafted SESSION_REATTACH packet to steal an already-established session. By doing so, the attacker assumes ongoing execution of the previously authenticated session, effectively impersonating a legitimate connected client. All versions from 1.0.0 through 2.44.0 (Apache ActiveMQ Artemis) and 2.50.0 through 2.56.0 (Apache Artemis) are affected, and version 2.57.0 fixes the issue. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.
  · Apache Artemis 2.50.0 through 2.56.0 (fixed in 2.57.0) · Apache ActiveMQ Artemis 1.0.0 through 2.44.0 (fixed in 2.57.0)large
• CVE-2026-675939.1<1%
  Pre-authentication queue deletion in Apache ActiveMQ Artemis via Openwire
  CVE-2026-67593 is a missing-authentication flaw (CWE-306) in the Openwire protocol handling of the Apache ActiveMQ Artemis message broker. A remote attacker can send a crafted Openwire RemoveSubscriptionInfo command that causes deletion of a queue on the broker before the connection authentication and authorization stage, or at any time thereafter. Because the command is accepted without authentication, an attacker with network access to the broker's Openwire interface can disrupt messaging operations by deleting queues without any valid credentials. All ActiveMQ Artemis versions from 1.0.0 through 2.44.0 and Artemis versions from 2.50.0 through 2.56.0 are affected, which covers essentially the product's entire version history. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known; the issue is fixed in version 2.57.0.
  · Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.0.0 through 2.44.0large
• CVE-2026-747617.5<1%
  Improper input validation in Apache ActiveMQ allows clientId spoofing
  Apache ActiveMQ contains an improper input validation flaw (CWE-20) in the TopicRegion component that manages durable topic subscriptions, affecting all platforms. An authenticated client can spoof another client's clientId when sending a remove-subscription request, causing the broker to delete a durable topic subscription that belongs to a different client. An attacker with valid broker credentials can thereby disrupt other clients' message delivery, since removing a durable subscription can make affected subscribers stop receiving topic messages; the issue is a spoofing/integrity and limited-availability problem, not remote code execution. Users of any of the three distributions (Apache ActiveMQ, ActiveMQ Broker, ActiveMQ All) on versions before 5.19.11 or 6.x from 6.0.0 before 6.3.2 are affected, particularly deployments that accept connections from third-party or multi-tenant authenticated clients. No public proof-of-concept or in-the-wild exploitation is known, the issue is not in CISA KEV, and CVSS scoring is still pending.
  · Apache ActiveMQ before 5.19.11; from 6.0.0 before 6.3.2 (fixed in 5.19.11 or 6.3.2) · Apache ActiveMQ Broker before 5.19.11; from 6.0.0 before 6.3.2 (fixed in 5.19.11 or 6.3.2)large
• CVE-2026-758806.5<1%
  Authenticated DoS via crafted wildcard message selectors in Apache ActiveMQ Artemis
  Apache ActiveMQ Artemis fails to bound the evaluation cost of message selectors, so a selector with crafted wildcard usage can trigger excessive processing (CWE-1333) each time the broker attempts message delivery. An authenticated client triggers it by attaching a consumer whose selector contains the crafted wildcards, and each delivery attempt then occupies a shared broker thread for a disproportionate amount of time. By sustaining this load (with one or more such consumers), the attacker can tie up broker threads and stall or degrade message delivery for other clients, achieving denial of service with no privilege escalation or data exposure. All users running Apache Artemis 2.50.0 through 2.56.0 or Apache ActiveMQ Artemis 1.0.0 through 2.44.0 are affected, which in practice covers essentially every Artemis release before 2.57.0 across standalone and embedded broker deployments. The flaw has no CVSS score yet, no known public proof-of-concept, is not listed in CISA KEV, and there are no known reports of exploitation in the wild.
  · Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.0.0 through 2.44.0large

Appears with