Exploit for Deserialization of Untrusted Data in Apache Activemq

ActiveMQ OpenWire Deserialization RCE CVE-2023-46604 Vulhu...

Apache Artemis Authentication Bypass

The vulnerability of asynchronous messaging systems like Apache ActiveMQ and Apache Artemis lies in the lack of authentication for critical functions. Exploiting this vulnerability can allow a malicious actor to gain full control over the application...

CVE-2026-47884 vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, apache-nifi-registry, datahub-gms-fips, camunda-zeebe, geoserver, apache-activemq, datahub-gms, camunda...

GHSA-PC63-QCMH-9CMG vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, apache-nifi-registry, datahub-gms-fips, camunda-zeebe, geoserver, apache-activemq, datahub-gms, camunda...

Apache ActiveMQ DoS

The vulnerability of the Apache ActiveMQ software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Security Bulletin: Due to the use of Apache ActiveMQ, IBM Sterling Control Center is vulnerable to Improper Input Validation (CVE-2026-74761)

Summary Apache ActiveMQ is used by IBM Sterling Control Center as part of dependency in activemq-all-5.19.0.jar. Vulnerability Details CVEID:CVE-2026-74761 DESCRIPTION: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. A...

ROS-20261002-73-0141

The vulnerability in Apache ActiveMQ is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2026-19032 vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, cassandra, apache-tika-fips, wildfly, seata, celeborn, spdx-tools-java, nextflow, traccar-fips, apache-pulsar-fips, apache-nifi, guacamole-client, apache-hop-fips, airbyte-platform, nacos, sonarqube, ontop-fips, druid, kafbat-ui-fips,...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, cassandra, apache-tika-fips, wildfly, seata, celeborn, spdx-tools-java, nextflow, traccar-fips, apache-pulsar-fips, apache-nifi, guacamole-client, apache-hop-fips, airbyte-platform, nacos, sonarqube, ontop-fips, druid, kafbat-ui-fips,...

CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ Jolokia 원격 코드 실행 RCE CVE-2026-34197은 Apache ActiveMQ Classic에 영향을 미치는 높은 심각도의 원격 코드 실행 RCE 취약점입니다. 이 문제는 /api/jolokia/ 엔드포인트를 통해 HTTP로 관리 작업을 노출하는 Jolokia JMX-HTTP 브리지에 존재합니다. 기본 Jolokia 액세스 정책은 인증된 사용자가 ActiveMQ MBeans에서 관리 작업을 호출할 수 있도록 허용합니다. 특정 브로커 관리 메서드는 사용자...

Hitachi Energy SOI

SUMMARY Hitachi Energy is aware of RCE Remote Code Execution vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confidentiality, integrity, and availability of the product...

CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

org.apache.activemq:artemis-features (>=2.31.1, <=2.33.0) potentially affected by CVE-2026-101292 via org.apache.activemq:artemis-core-client-osgi (>=2.31.1, <=2.33.0)

org.apache.activemq:artemis-core-client-osgi MAVEN version =2.31.1, =2.31.1, =2.33.0 Source cves: CVE-2026-101292 Source advisory: MEND:CVE-2026-101292...

CVE-2026-101292 Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

org.apache.activemq:artemis-features (>=2.31.1, <=2.33.0) potentially affected by CVE-2026-101292 via org.apache.activemq:artemis-jms-client-osgi (>=2.31.1, <=2.33.0)

org.apache.activemq:artemis-jms-client-osgi MAVEN version =2.31.1, =2.31.1, =2.33.0 Source cves: CVE-2026-101292 Source advisory: MEND:CVE-2026-101292...

CVE-2026-101292 Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-101292

Apache ActiveMQ Artemis versions before 2.34.0 are vulnerable to an unsafe reflection vulnerability within the FederationStreamConnectMessage.getFederationPolicy() method. The root cause is the direct reading of a class name from the CORE protocol wire buffer without proper type validation, which...

EUVD-2026-88242

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-101292: Use of Externally-Controlled Input to Select Classes or Code

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...