wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

io.quarkiverse.artemis:quarkus-test-artemis (>=3.12.0, <=3.14.3), net.oneandone.ioc-unit:ioc-unit-jms-artemisactivemq (>=6.0.0, <=6.0.1) +35 more potentially affected by CVE-2026-57967 via org.apache.artemis:artemis-server (>=2.50.0, <=2.56.0)

org.apache.artemis:artemis-server MAVEN version =2.50.0, =3.12.0, =6.0.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.56.0 and more Source cves: CVE-2026-57967 Source advisory: SNYK:JAVA-ORGAPACHEARTEMIS-20159146...

Missing Authentication for Critical Function

Overview org.apache.activemq:artemis-server is a server package for the ActiveMQ-Artemis project. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the SESSIONREATTACH. An attacker can gain unauthorized access to an existing session and assume th...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the SESSIONREATTACH. An attacker can gain unauthorized access to an existing session and assume the privileges of a previously authenticated user by sending a specially crafted CORE...

com.atomikos:transactions-spring-boot-integration-tests (>=5.0.9, <=6.0.1), com.atomikos:transactions-spring-boot3-integration-tests (>=6.0.0m1, <=6.0.1) +231 more potentially affected by CVE-2026-49362 via org.apache.activemq:artemis-server (>=1.0.0, <=2.54.0)

org.apache.activemq:artemis-server MAVEN version =1.0.0, =5.0.9, =6.0.0m1, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =0.37, =0.43, =0.22, =0.22, =0.22, =0.22, =0.3, =0.9 and more Source cves: CVE-2026-49362 Source advisory:...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the CORE protocol handler. An attacker can manipulate broker state and create arbitrary durable queues by sending unauthenticated requests. Remediation Upgrade...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the initial cluster connection handshake. An attacker can obtain administrative credentials by capturing network traffic during the handshake. Remediation Upgrade...

Missing Authentication for Critical Function

Overview org.apache.activemq:artemis-server is a server package for the ActiveMQ-Artemis project. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the handlePacket process of CoreProtocolManager.LocalChannelHandler when processing topology...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the handlePacket process of CoreProtocolManager.LocalChannelHandler when processing topology subscription requests on channel0 without authentication. An attacker can access sensitive brok...

io.quarkiverse.artemis:quarkus-test-artemis (>=3.12.0, <=3.14.3), net.oneandone.ioc-unit:ioc-unit-jms-artemisactivemq (>=6.0.0, <=6.0.1) +35 more potentially affected by CVE-2026-49362 via org.apache.artemis:artemis-server (>=2.50.0, <=2.56.0)

org.apache.artemis:artemis-server MAVEN version =2.50.0, =3.12.0, =6.0.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.56.0 and more Source cves: CVE-2026-49362 Source advisory: MEND:CVE-2026-49362...

com.atomikos:transactions-spring-boot-integration-tests (>=5.0.9, <=6.0.1), com.atomikos:transactions-spring-boot3-integration-tests (>=6.0.0m1, <=6.0.1) +231 more potentially affected by CVE-2026-57967 via org.apache.activemq:artemis-server (>=1.0.0, <=2.54.0)

org.apache.activemq:artemis-server MAVEN version =1.0.0, =5.0.9, =6.0.0m1, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =0.37, =0.43, =0.22, =0.22, =0.22, =0.22, =0.3, =0.9 and more Source cves: CVE-2026-57967 Source advisory: MEND:CVE-2026-57967...