BIT-ACTIVEMQ-2026-33227 Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances when creating a Stomp consumer and also browsing messages in the Web console an authenticated...

be.yildiz-games:module-messaging-activemq (=2.0.0), cn.hutool.v7:hutool-extra (>=7.0.0-M2 <=7.0.0-M5) +167 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-client (>=6.0.0 <=6.2.1)

org.apache.activemq:activemq-client MAVEN version =6.0.0, =7.0.0-M2, =1.1.0, =2.55.0, =1.0.5, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =1.1.0, =7.0.0, =7.0.0, =7.0.1 and more Source cves: CVE-2026-33227 Source advisory: OSV:GHSA-H2H4-5M64-M273...

Directory Traversal

Overview org.apache.activemq:activemq-client is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Affected versions of this package are vulnerable to Directory Traversal via improper validation of classpath path names in the key parameter during the creation of a...

be.yildiz-games:module-messaging-activemq (=2.0.0), cn.hutool.v7:hutool-extra (>=7.0.0-M2 <=7.0.0-M5) +167 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-client (>=6.0.0 <=6.2.1)

org.apache.activemq:activemq-client MAVEN version =6.0.0, =7.0.0-M2, =1.1.0, =2.55.0, =1.0.5, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =1.1.0, =7.0.0, =7.0.0, =7.0.1 and more Source cves: CVE-2026-33227 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-15930948...

at.chrl:chrl-jms (=1.1.0), at.researchstudio.sat:won-core (>=0.2 <=0.9) +1350 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-client (>=5.10.0 <=5.19.2)

org.apache.activemq:activemq-client MAVEN version =5.10.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner =0.3 - at.researchstudio.sat:won-owner-webapp =0.3 and more Source cves: CVE-2026-33227 Source advisory:...

EUVD-2026-19586

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All. In two instances when creating a Stomp consumer and also browsing messages in the Web console an authenticated user provided "key" value could be...

CVE-2026-33227

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances when creating a Stomp consumer and also browsing messages in the Web console an authenticated...

UBUNTU-CVE-2026-33227

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances when creating a Stomp consumer and also browsing messages in the Web console an authenticated...

CVE-2026-33227

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All. In two instances when creating a Stomp consumer and also browsing messages in the Web console an authenticated user provided "key" value could be...

CVE-2026-33227 Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances when creating a Stomp consumer and also browsing messages in the Web console an authenticated...

PT-2026-30804

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Client versions prior to 5.19.3, from 6.0.0 through 6.2.2 Apache ActiveMQ Broker versions prior to 5.19.3, from 6.0.0 through 6.2.2 Apache ActiveMQ All versions prior to 5.19.3, from 6.0.0 through 6.2.2 Description An improper...

EUVD-2018-0638

Malware in sbrugna...

EUVD-2022-4703

Malicious code in bioql PyPI...

be.yildiz-games:module-messaging-activemq (=1.0.15), com.chutneytesting:action-impl (>=2.2.1 <=3.0.0) +114 more potentially affected by CVE-2025-27533 via org.apache.activemq:activemq-client (>=5.18.0 <=5.18.6)

org.apache.activemq:activemq-client MAVEN version =5.18.0, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =2.0.0, =0.4.4, =0.4.4, =0.28.0, =2.0.0, =3.0.0, =0.17.0, =RC0-0.19.12-2023-10-27, =RC0-0.19.12-2023-10-27, =RC0-0.19.12-2023-10-27, =RC-1.0.0.RC4+2025-05-15 and more Source cves: CVE-2025-27533 Source...

be.yildiz-games:module-messaging-activemq (=2.0.0), com.codbex.atlas:codbex-atlas-application (>=1.1.0 <=2.110.0) +103 more potentially affected by CVE-2025-27533 via org.apache.activemq:activemq-client (>=6.0.0 <=6.1.5)

org.apache.activemq:activemq-client MAVEN version =6.0.0, =1.1.0, =2.55.0, =1.0.5, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =1.1.0, =7.0.0, =7.0.0, =7.0.0, =7.0.1 and more Source cves: CVE-2025-27533 Source advisory: OSV:GHSA-WHXR-3P84-RF3C...

com.chutneytesting:chutney-kotlin-dsl (>=0.1.18 <=1.0.1), com.codbex.aion:codbex-aion-platform (>=0.5.6 <=0.5.7) +218 more potentially affected by CVE-2025-27533 via org.apache.activemq:activemq-client (>=5.17.0 <=5.17.6)

org.apache.activemq:activemq-client MAVEN version =5.17.0, =0.1.18, =0.5.6, =0.5.6, =0.5.6, =0.3.0, =0.3.0, =0.5.3, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.4.0 and more Source cves: CVE-2025-27533 Source advisory: OSV:GHSA-WHXR-3P84-RF3C...

com.chutneytesting:chutney-kotlin-dsl (>=0.1.18 <=1.0.1), com.codbex.aion:codbex-aion-platform (>=0.5.6 <=0.5.7) +218 more potentially affected by CVE-2025-27533 via org.apache.activemq:activemq-client (>=5.17.0 <=5.17.6)

org.apache.activemq:activemq-client MAVEN version =5.17.0, =0.1.18, =0.5.6, =0.5.6, =0.5.6, =0.3.0, =0.3.0, =0.5.3, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.4.0 and more Source cves: CVE-2025-27533 Source advisory:...

be.yildiz-games:module-messaging-activemq (=2.0.0), com.codbex.atlas:codbex-atlas-application (>=1.1.0 <=2.110.0) +103 more potentially affected by CVE-2025-27533 via org.apache.activemq:activemq-client (>=6.0.0 <=6.1.5)

org.apache.activemq:activemq-client MAVEN version =6.0.0, =1.1.0, =2.55.0, =1.0.5, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =1.1.0, =7.0.0, =7.0.0, =7.0.0, =7.0.1 and more Source cves: CVE-2025-27533 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-10074037...

Memory Allocation with Excessive Size Value

Overview org.apache.activemq:activemq-client is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value during the unmarshalling of OpenWire commands, where the size value of...

at.chrl:chrl-jms (=1.1.0), at.researchstudio.sat:won-core (>=0.2 <=0.9) +1242 more potentially affected by CVE-2025-27533 via org.apache.activemq:activemq-client (>=5.10.0 <=5.16.7)

org.apache.activemq:activemq-client MAVEN version =5.10.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner =0.3 - at.researchstudio.sat:won-owner-webapp =0.3 and more Source cves: CVE-2025-27533 Source advisory:...