CVE-2026-108946

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client...

CVE-2026-111821

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length 65,535 while separately being shorter on a broker using KahaDB which can cause the broker to shutdown and ...

CVE-2026-108946

Apache ActiveMQ and Apache ActiveMQ KahaDB are vulnerable to an improper input validation issue where the broker resolves connection, session, and consumer states from user-provided IDs without verifying they are bound to the requesting user. This allows an authenticated client to spoof another u...

CVE-2026-108946 Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client...

EUVD-2026-116828

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client...

CVE-2026-111821

Apache ActiveMQ and Apache ActiveMQ KahaDB are vulnerable to an improper input validation flaw where creating a durable subscription with a combined clientId and subscription name length exceeding 65,535 bytes poisons the KahaDB journal . This condition can cause the broker to shut down and remai...

EUVD-2026-116826

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length 65,535 while separately being shorter on a broker using KahaDB which can cause the broker to shutdown and ...

CVE-2026-111821

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length 65,535 while separately being shorter on a broker using KahaDB which can cause the broker to shutdown and ...

CVE-2026-111821: Apache Software Foundation: Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length 65,535 while separately being shorter on a broker using KahaDB which can cause the broker to shutdown and ...

PT-2026-136916

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client...

CVE-2026-108946: Apache Software Foundation: Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client...

com.io7m.jsay:com.io7m.jsay (>=0.0.1, <=0.0.2), com.jkoolcloud.tnt4j.streams:tnt4j-streams-jms (>=1.14.2, <=2.3.0) +5 more potentially affected by CVE-2026-32642 via org.apache.activemq:artemis-openwire-protocol (>=2.0.0, <=2.44.0)

org.apache.activemq:artemis-openwire-protocol MAVEN version =2.0.0, =0.0.1, =1.14.2, =0.1.0, =0.1.0, =2.0.0, =2.31.1, =2.29.0, =2.44.0 Source cves: CVE-2026-32642 Source advisory: OSV:GHSA-F4GC-MWRG-Q36R...