GHSA-M8G6-VRR2-X7FF vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, apache-activemq...

CVE-2026-56130 vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, apache-activemq...

CVE-2026-108500

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters such as comma, plus, equals, backslash can manipulate the LDAP search ba...

CVE-2026-108946

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client...

CVE-2026-108500 Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters such as comma, plus, equals, backslash can manipulate the LDAP search ba...

CVE-2026-108500

Apache ActiveMQ is impacted by an input validation vulnerability when configured with the LDAPAuthorizationMapPlugin . An authenticated attacker can create or address a destination using a crafted name containing LDAP DN special characters (such as comma, plus, equals, or backslash). This allows ...

EUVD-2026-116865

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters such as comma, plus, equals, backslash can manipulate the LDAP search ba...

CVE-2026-111821

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length 65,535 while separately being shorter on a broker using KahaDB which can cause the broker to shutdown and ...

CVE-2026-111822

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination,...

CVE-2026-108949

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region'...

CVE-2026-108946

Apache ActiveMQ and Apache ActiveMQ KahaDB are vulnerable to an improper input validation issue where the broker resolves connection, session, and consumer states from user-provided IDs without verifying they are bound to the requesting user. This allows an authenticated client to spoof another u...

CVE-2026-108946

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client...

CVE-2026-108946 Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client...

EUVD-2026-116828

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client...

CVE-2026-111822

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination,...

CVE-2026-111822 Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination,...

CVE-2026-111822

Apache ActiveMQ and Apache ActiveMQ Runtime Config are vulnerable to improper invalidation of cached authorizations . When the runtime configuration plugin removes a principal's write grant on a destination via a live ACL update, the system fails to invalidate the existing cache. This allows an a...

EUVD-2026-116827

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination,...

CVE-2026-111821

Apache ActiveMQ and Apache ActiveMQ KahaDB are vulnerable to an improper input validation flaw where creating a durable subscription with a combined clientId and subscription name length exceeding 65,535 bytes poisons the KahaDB journal . This condition can cause the broker to shut down and remai...

EUVD-2026-116826

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length 65,535 while separately being shorter on a broker using KahaDB which can cause the broker to shutdown and ...