CVE-2026-108946
UnknownSummary
An improper input validation vulnerability in Apache ActiveMQ and Apache ActiveMQ KahaDB. The broker resolves connection, session and consumer state from user-provided ids and in some scenarios does not validate that they are bound to that user, allowing an authenticated client to spoof another user's ids.
Risk Assessment
An authenticated client can hijack or tear down another user's subscriptions, consume from their temporary queues, or permanently delete an unacknowledged message. This compromises confidentiality and integrity of messaging.
Recommendation
Upgrade Apache ActiveMQ to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue. Restrict authenticated client access to the minimum necessary.
Other vulnerabilities in Apache ActiveMQ
See all- CVE-2026-108500Unknown
An input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters, manipulating the LDAP search base used for ACL lookups.
- CVE-2026-111822Unknown
Apache ActiveMQ and Apache ActiveMQ Runtime Config contain an improper invalidation of cached authorizations vulnerability. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. This affects Apache ActiveMQ from 6.0.0 before 6.3.3 and before 5.19.12, and Apache ActiveMQ Runtime Config in the same ranges.
- CVE-2026-111821Unknown
Apache ActiveMQ and Apache ActiveMQ KahaDB contain an improper input validation vulnerability. A user can create a durable subscription with a clientId and subscription name whose combined length exceeds 65,535 (while each is individually shorter) on a broker using KahaDB, which can cause the broker to shut down and become unrecoverable. This affects Apache ActiveMQ from 6.0.0 before 6.3.3 and before 5.19.12, and Apache ActiveMQ KahaDB in the same ranges.
- CVE-2014-3576High
The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before version 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.
- CVE-2026-40466High
A vulnerability in Apache ActiveMQ allows an authenticated attacker to bypass the fix for CVE-2026-34197 by adding a connector using HTTP Discovery transport. The attacker can use a malicious HTTP endpoint returning a VM transport, leading to loading a remote Spring XML application context and arbitrary code execution on the broker's JVM.
- CVE-2026-34197HighActively exploited
A vulnerability in Apache ActiveMQ allows an authenticated attacker to achieve remote code execution on the broker via the Jolokia JMX-HTTP endpoint. The attack invokes network connector operations with a crafted URI that loads a remote Spring XML context, leading to arbitrary code execution in the broker's JVM.
- CVE-2015-5254Critical
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, allowing remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
- CVE-2026-108949Medium
Apache ActiveMQ and ActiveMQ Broker contain a denial of service via OOM vulnerability. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This affects Apache ActiveMQ from 6.0.0 before 6.3.3 and before 5.19.12, and ActiveMQ Broker in the same ranges.
- CVE-2026-74761High
Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription.
- CVE-2026-61487Medium
Improper authorization in Apache ActiveMQ allows an authenticated low-privilege user to bypass per-destination write ACLs by sending to a temporary composite destination, bypassing the authorization check.
Original NVD description (English source)
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client to spoof another user's ids. This allows: * an authenticated client consumes from another connection's temporary queue/topic by putting the victim's connection id in its own ConsumerId, bypassing the broker-side ownership check. * a duplicate ConsumerId registration is only logged, after which the attacker's RemoveInfo or disconnect tears down the victim's live subscription * a forged MessageAck for the victim's ConsumerId permanently deletes an in-flight, unacknowledged message. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS