Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Five Vulnerabilities Disclosed in Apache ActiveMQ

1 source · 5 articlesFirst reported Updated ()
What's new

November 3: CVE-2026-111822 disclosed, allowing continued write access after live ACL revocation.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Five vulnerabilities in Apache ActiveMQ before 6.3.3 and 5.19.12 enable authorization bypass, DoS, and journal poisoning.

Multiple vulnerabilities have been disclosed in Apache ActiveMQ and KahaDB. CVE-2026-108500 allows authenticated attackers to bypass authorization through DN injection in destination names. CVE-2026-108946 involves improper validation of user-provided connection IDs that can resolve broker state incorrectly. CVE-2026-108949 leads to denial of service via out-of-memory errors from repeated rejected temporary destination requests. CVE-2026-111821 permits poisoning the KahaDB journal through oversized combined clientId and subscription names. CVE-2026-111822 allows continued write access to destinations after live ACL revocation due to cached authorization flaws. All issues affect versions before 6.3.3 and 5.19.12. No patches or exploitation have been reported.

Key facts
  • CVE-2026-108500: auth bypass via DN injection in LDAPAuthorizationMap
  • CVE-2026-108946: unvalidated connection ID resolution in broker
  • CVE-2026-108949: OOM DoS from repeated ConsumerInfo requests
  • CVE-2026-111821: KahaDB journal poisoning with >65,535-byte clientId/subscription names
  • CVE-2026-111822: retained write access after ACL revocation
  • Affects: Apache ActiveMQ <6.3.3 and <5.19.12
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-111822CVE-2026-111821CVE-2026-108946CVE-2026-108949CVE-2026-108500
Vendors
Apache
Products
ActiveMQKahaDBActiveMQ Broker

Coverage

oldest first · one row per article · UTC
  1. · 8d ago oss-securityFirst report

    Apache ActiveMQ LDAPAuthorizationMap allows authorization bypass via DN injection (CVE-2026-108500)

    Authenticated attackers can create destinations with crafted DN names containing special characters in versions before 6.3.3 and 5.19.12.

  2. · 8d ago oss-security

    CVE-2026-108946: Apache ActiveMQ broker does not verify user provided connection ID (CVE-2026-108946)

    User provided connection IDs are not validated against bound connection state in versions before 6.3.3 and 5.19.12.

  3. · 8d ago oss-security

    CVE-2026-108949: Apache ActiveMQ broker vulnerable to repeated temporary destination requests (CVE-2026-108949)

    Repeated rejected ConsumerInfo requests for temporary destinations can lead to broker OOM in versions before 6.3.3 and 5.19.12.

  4. · 8d ago oss-security

    CVE-2026-111821: Apache ActiveMQ KahaDB vulnerable to oversized client identifier poisoning (CVE-2026-111821)

    Combined clientId and subscription name exceeding 65,535 bytes can poison the KahaDB journal in versions before 6.3.3 and 5.19.12.

  5. · 8d ago oss-security

    Apache ActiveMQ retains write access after ACL revocation

    Cached authorization flaw allows continued write access after live ACL removal in versions before 6.3.3.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111822
+4 related CVEs
CVE-2026-111821CVE-2026-108949CVE-2026-108946CVE-2026-108500
Cached authorizations bypass in Apache ActiveMQ after ACL revocation
8.1
group max
—