CVE-2026-67593 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

org.apache.artemis:apache-artemis (>=2.50.0, <=2.56.0), org.apache.artemis:artemis-features (>=2.50.0, <=2.56.0) +1 more potentially affected by CVE-2026-67593 via org.apache.artemis:artemis-openwire-protocol (>=2.50.0, <=2.56.0)

org.apache.artemis:artemis-openwire-protocol MAVEN version =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.56.0 Source cves: CVE-2026-67593 Source advisory: MEND:CVE-2026-67593...

CVE-2026-67593

An unauthenticated network attacker can delete arbitrary durable queues on an Apache Artemis broker (or Apache ActiveMQ Artemis ) with the OpenWire protocol enabled. The vulnerability exists because the processRemoveSubscription() method executes pre-authentication without authorization checks, u...

CVE-2026-67593 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

EUVD-2026-75245

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

CVE-2026-50734

An unauthenticated network attacker can cause a Denial of Service (DoS) on an Apache ActiveMQ broker by sending a crafted WireFormatInfo frame containing a malicious large size value. The broker fails to validate this value during pre-authentication negotiation, triggering an Out of Memory (OOM) ...

CVE-2026-50750 Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broke...

CVE-2026-53917

A Memory Allocation with Excessive Size Value vulnerability (CWE-789) exists in Apache ActiveMQ , Apache ActiveMQ All , Apache ActiveMQ Client , and Apache ActiveMQ Broker . An authenticated user can trigger a Denial of Service (DoS) by sending a crafted OpenWire Message containing a large encode...

Linux Distros Unpatched Vulnerability : CVE-2026-32642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect Authorization CWE-863 vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to crea...

com.io7m.jsay:com.io7m.jsay (>=0.0.1, <=0.0.2), com.jkoolcloud.tnt4j.streams:tnt4j-streams-jms (>=1.14.2, <=2.3.0) +5 more potentially affected by CVE-2026-32642 via org.apache.activemq:artemis-openwire-protocol (>=2.0.0, <=2.44.0)

org.apache.activemq:artemis-openwire-protocol MAVEN version =2.0.0, =0.0.1, =1.14.2, =0.1.0, =0.1.0, =2.0.0, =2.31.1, =2.29.0, =2.44.0 Source cves: CVE-2026-32642 Source advisory: GHSA-F4GC-MWRG-Q36R...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the OpenWire protocol when an authenticated user with the createDurableQueue permission but without the createAddress permission attempts to create a non-durable JMS topic subscription on a non-existent addres...

com.io7m.jsay:com.io7m.jsay (>=0.0.1, <=0.0.2), com.jkoolcloud.tnt4j.streams:tnt4j-streams-jms (>=1.14.2, <=2.3.0) +5 more potentially affected by CVE-2026-32642 via org.apache.activemq:artemis-openwire-protocol (>=2.0.0, <=2.44.0)

org.apache.activemq:artemis-openwire-protocol MAVEN version =2.0.0, =0.0.1, =1.14.2, =0.1.0, =0.1.0, =2.0.0, =2.31.1, =2.29.0, =2.44.0 Source cves: CVE-2026-32642 Source advisory: OSV:GHSA-F4GC-MWRG-Q36R...

com.io7m.jsay:com.io7m.jsay (>=0.0.1, <=0.0.2), com.jkoolcloud.tnt4j.streams:tnt4j-streams-jms (>=1.14.2, <=2.3.0) +5 more potentially affected by CVE-2026-32642 via org.apache.activemq:artemis-openwire-protocol (>=2.0.0, <=2.44.0)

org.apache.activemq:artemis-openwire-protocol MAVEN version =2.0.0, =0.0.1, =1.14.2, =0.1.0, =0.1.0, =2.0.0, =2.31.1, =2.29.0, =2.44.0 Source cves: CVE-2026-32642 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-15791526...

org.apache.artemis:apache-artemis (>=2.50.0, <=2.52.0), org.apache.artemis:artemis-features (>=2.50.0, <=2.52.0) +1 more potentially affected by CVE-2026-32642 via org.apache.artemis:artemis-openwire-protocol (>=2.50.0, <=2.52.0)

org.apache.artemis:artemis-openwire-protocol MAVEN version =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.52.0 Source cves: CVE-2026-32642 Source advisory: GHSA-F4GC-MWRG-Q36R...

GHSA-F4GC-MWRG-Q36R Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol

Incorrect Authorization CWE-863 vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue"...

Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol

Incorrect Authorization CWE-863 vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue"...

Incorrect Authorization

Overview org.apache.activemq:artemis-openwire-protocol is a package for activemq. Affected versions of this package are vulnerable to Incorrect Authorization in the OpenWire protocol when an authenticated user with the createDurableQueue permission but without the createAddress permission attempt...

org.apache.artemis:apache-artemis (>=2.50.0, <=2.52.0), org.apache.artemis:artemis-features (>=2.50.0, <=2.52.0) +1 more potentially affected by CVE-2026-32642 via org.apache.artemis:artemis-openwire-protocol (>=2.50.0, <=2.52.0)

org.apache.artemis:artemis-openwire-protocol MAVEN version =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.52.0 Source cves: CVE-2026-32642 Source advisory: SNYK:JAVA-ORGAPACHEARTEMIS-15791525...

org.apache.artemis:apache-artemis (>=2.50.0, <=2.52.0), org.apache.artemis:artemis-features (>=2.50.0, <=2.52.0) +1 more potentially affected by CVE-2026-32642 via org.apache.artemis:artemis-openwire-protocol (>=2.50.0, <=2.52.0)

org.apache.artemis:artemis-openwire-protocol MAVEN version =2.50.0, =2.50.0, =2.50.0, =2.50.0, =2.52.0 Source cves: CVE-2026-32642 Source advisory: OSV:GHSA-F4GC-MWRG-Q36R...

CVE-2026-32642

Incorrect Authorization CWE-863 vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue"...