CVE-2026-108500

An improper input validation vulnerability in Apache ActiveMQ and Apache ActiveMQ KahaDB. The broker resolves connection, session and consumer state from user-provided ids and in some scenarios does not validate that they are bound to that user, allowing an authenticated client to spoof another user's ids.

Apache ActiveMQ and Apache ActiveMQ Runtime Config contain an improper invalidation of cached authorizations vulnerability. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. This affects Apache ActiveMQ from 6.0.0 before 6.3.3 and before 5.19.12, and Apache ActiveMQ Runtime Config in the same ranges.

Apache ActiveMQ and Apache ActiveMQ KahaDB contain an improper input validation vulnerability. A user can create a durable subscription with a clientId and subscription name whose combined length exceeds 65,535 (while each is individually shorter) on a broker using KahaDB, which can cause the broker to shut down and become unrecoverable. This affects Apache ActiveMQ from 6.0.0 before 6.3.3 and before 5.19.12, and Apache ActiveMQ KahaDB in the same ranges.

The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before version 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.

A vulnerability in Apache ActiveMQ allows an authenticated attacker to bypass the fix for CVE-2026-34197 by adding a connector using HTTP Discovery transport. The attacker can use a malicious HTTP endpoint returning a VM transport, leading to loading a remote Spring XML application context and arbitrary code execution on the broker's JVM.

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, allowing remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Apache ActiveMQ and ActiveMQ Broker contain a denial of service via OOM vulnerability. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This affects Apache ActiveMQ from 6.0.0 before 6.3.3 and before 5.19.12, and ActiveMQ Broker in the same ranges.

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription.

Improper authorization in Apache ActiveMQ allows an authenticated low-privilege user to bypass per-destination write ACLs by sending to a temporary composite destination, bypassing the authorization check.