Apache ActiveMQ vulnerabilities

The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before version 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.

A vulnerability in Apache ActiveMQ allows an authenticated attacker to bypass the fix for CVE-2026-34197 by adding a connector using HTTP Discovery transport. The attacker can use a malicious HTTP endpoint returning a VM transport, leading to loading a remote Spring XML application context and arbitrary code execution on the broker's JVM.

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, allowing remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Improper authorization in Apache ActiveMQ allows an authenticated low-privilege user to bypass per-destination write ACLs by sending to a temporary composite destination, bypassing the authorization check.

Apache ActiveMQ (versions before 5.19.9 and 6.0.0 before 6.2.8) has a vulnerability in the AMQP NIO component. A remote unauthenticated attacker can send a frame with a specific size, causing NIO threads to die. Rapid repetition can exhaust the NIO thread pool, leading to denial of service.

A missing authorization vulnerability was found in Apache ActiveMQ for temporary destinations. Temporary destinations are expected to be isolated to the connection that created them, but the isolation is only checked on the client side, allowing a different connection to consume from another connection's temporary destination.

A vulnerability in Apache ActiveMQ allows an authenticated user to cause a DoS attack on the broker by sending a crafted OpenWire message with an excessive map size value. The lack of size validation during deserialization of message property maps can trigger OOM and crash the broker.

A vulnerability in Apache ActiveMQ allows an unauthenticated client to send non-terminating header bytes via STOMP NIO, causing unlimited buffering and JVM heap exhaustion.

A Cross-site Scripting (XSS) vulnerability was found in Apache ActiveMQ and its Web Console. The browse page renders a message ID without sanitization, allowing an authenticated producer to send a crafted JMS message ID containing HTML/JavaScript. When an administrator browses the queue, the payload executes in their browser.

A vulnerability in Apache ActiveMQ allows an unauthenticated attacker to cause Out of Memory (OOM) by sending repeated BrokerInfo commands without ConnectionInfo, leading to broker crash.

A vulnerability in Apache ActiveMQ allows an unauthenticated attacker to remotely cause a Denial of Service (DoS) of the broker by sending a crafted WireFormatInfo frame with a maliciously large size value. The lack of validation leads to memory allocation attempts during pre-auth negotiation, potentially causing an Out-of-Memory (OOM) condition and broker crash.

An improper authorization vulnerability was found in Apache ActiveMQ. By default, an authenticated low-privilege Web Console user can access /admin/* paths, which should be restricted to admins. The issue is caused by incorrect default Jetty settings.

An improper input validation vulnerability in Apache ActiveMQ allows an attacker with LDAP access to instantiate denied transports within the broker JVM. This can be exploited to fetch a malicious URL and spawn a second BrokerService in the same JVM.

An improper input validation vulnerability exists in Apache ActiveMQ's STOMP protocol. A remote unauthenticated attacker can send a negative content-length header, causing denial-of-service (DoS). For NIO STOMP transport, this leads to out-of-memory (OOM), while for blocking STOMP it causes connection errors and closure.

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers configured with a network connector with syncDurableSubs set to true are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated.

Incorrect Default Permissions vulnerability in Apache ActiveMQ. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. This affects versions before 5.19.7 and from 6.0.0 before 6.2.6.

Incomplete authorization in Apache ActiveMQ server before versions 6.2.6 and 5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

A vulnerability in Apache ActiveMQ allows bypassing the fix for CVE-2026-34197 due to improper validation of discovery wrappers (e.g., `masterslave:vm://...`). An authenticated attacker can exploit the Jolokia JMX-HTTP bridge to invoke MBean operations, leading to remote code execution on the broker.

Apache ActiveMQ before versions 5.19.7 and 6.2.6 has a code injection vulnerability via the Jolokia JMX-HTTP bridge. An authenticated attacker can invoke BrokerService.addNetworkConnector with a crafted URI that loads a Spring XML context, leading to remote code execution on the broker's JVM.

A Cross-site Scripting vulnerability was found in Apache ActiveMQ and Apache ActiveMQ Web in the MessageServlet component. JMS message properties are copied into HTTP response headers without validation, allowing security header injection.

A vulnerability in Apache ActiveMQ allows an authenticated attacker to inject malicious configuration via the admin web console. The attacker can craft a broker name containing a malicious xbean binding that, when triggered by VM transport, loads a remote Spring XML file. This leads to arbitrary code execution on the broker's JVM.

A denial of service vulnerability in Apache ActiveMQ allows memory exhaustion via TLSv1.3 handshake KeyUpdates. A client can rapidly trigger updates, exhausting the broker's SSL engine memory.