CVE-2026-49363

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBETOPOLOGYV2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore, no credential...

CVE-2026-57822

A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray method uses ObjectInputStream.readObject to deserialize CompositeData from Base64-encoded serialized objects in management message bodies sent to the activemq.management address. While the deserialization is protected by an...

CVE-2026-49362

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

EUVD-2026-75247

When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not...

CVE-2026-57822

Apache Artemis (2.50.0–2.56.0) and Apache ActiveMQ Artemis (1.3.0–2.44.0) are vulnerable to a denial of service when processing message-based management requests. The JsonUtil.fromJsonArray() method deserializes method parameters via ObjectInputStream.readObject(); while an allowlist (java.util, ...

EUVD-2026-75246

An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0...

CVE-2026-67593 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

CVE-2023-50780

CVE-2023-50780: MBeans peligrosos accesibles a través de la API de Jolokia en Apache ActiveMQ Artemis Al listar e inspeccionar los MBeans expuestos por la API de Jolokia en http://127.0.0.1:8161/console/jolokia se han identificado los siguientes vectores de ataque: Escritura arbitraria de archivo...

CLEANSTART-2026-DV18988 Security fixes in apache-activemq-artemis 2.56.0-r1

Package apache-activemq-artemis version 2.56.0-r1 fixes 15 vulnerabilities: CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-41417...

ROOT-APP-MAVEN-CVE-2025-27391 CVE-2025-27391 in io.root.org.apache.activemq:artemis-project - Patched by Root

Root has patched CVE-2025-27391 in the io.root.org.apache.activemq:artemis-project package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-WZ84296 Security fixes in apache-activemq-artemis 2.53.0-r0

Package apache-activemq-artemis version 2.53.0-r0 fixes 2 vulnerabilities: ghsa-pwqr-wmgm-9rr8, CVE-2026-33870...

CLEANSTART-2026-OU92014 Security fixes in apache-activemq-artemis 2.51.0-r0

Package apache-activemq-artemis version 2.51.0-r0 fixes 4 vulnerabilities: CVE-2026-24308, CVE-2026-24281, ghsa-7xrh-hqfc-g7qr, ghsa-crhr-qqj8-rpxc...

GHSA-RF99-F9J2-GV3F Apache Artemis has an Incorrect Authorization issue

A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for...

org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication

A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation...

Siemens Opcenter RDnL

SUMMARY Opcenter RDnL is affected by missing authentication in critical function in ‘ActiveMQ Artemis’. An unauthenticated attacker within the adjacent network could use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue...

GHSA-H2H4-5M64-M273 vulnerabilities

Vulnerabilities for packages: zipkin, apache-activemq-artemis...

CVE-2026-39304 vulnerabilities

Vulnerabilities for packages: zipkin, apache-activemq-artemis...

GHSA-5568-6QCG-G7FX vulnerabilities

Vulnerabilities for packages: zipkin, apache-activemq-artemis...

CVE-2026-33227 vulnerabilities

Vulnerabilities for packages: zipkin, apache-activemq-artemis...

Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol

Incorrect Authorization CWE-863 vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue"...