Apache

Activemq

58 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2026-41044

  • EPSS 0.15%
  • Veröffentlicht 24.04.2026 10:16:53
  • Zuletzt bearbeitet 27.04.2026 14:49:13

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious...

6.5

CVE-2026-41043

  • EPSS 0.19%
  • Veröffentlicht 24.04.2026 10:16:23
  • Zuletzt bearbeitet 27.04.2026 14:49:24

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing queues in the web console by overriding the conte...

8.8

CVE-2026-40466

  • EPSS 10.33%
  • Veröffentlicht 24.04.2026 10:15:44
  • Zuletzt bearbeitet 27.04.2026 12:23:15

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connecto...

7.5

CVE-2026-39304

  • EPSS 0.08%
  • Veröffentlicht 10.04.2026 10:54:04
  • Zuletzt bearbeitet 01.05.2026 15:21:36

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a...

7.5

CVE-2026-40046

  • EPSS 0.05%
  • Veröffentlicht 09.04.2026 17:16:31
  • Zuletzt bearbeitet 13.04.2026 15:02:27

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.1...

4.3

CVE-2026-33227

  • EPSS 0.08%
  • Veröffentlicht 07.04.2026 07:50:58
  • Zuletzt bearbeitet 20.04.2026 16:50:36

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also b...

8.8

CVE-2026-34197

Warnung Medienbericht
  • EPSS 75.81%
  • Veröffentlicht 07.04.2026 07:50:10
  • Zuletzt bearbeitet 16.04.2026 19:59:38

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The defau...

8.8

CVE-2025-66168

  • EPSS 0.08%
  • Veröffentlicht 04.03.2026 08:45:00
  • Zuletzt bearbeitet 10.04.2026 11:16:21

WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the  following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/...

7.5

CVE-2025-27533

  • EPSS 2.25%
  • Veröffentlicht 07.05.2025 09:15:18
  • Zuletzt bearbeitet 03.11.2025 20:18:02

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a ...

8.8

CVE-2024-32114

Medienbericht
  • EPSS 72.63%
  • Veröffentlicht 02.05.2024 09:15:06
  • Zuletzt bearbeitet 11.02.2025 16:31:00

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, an...