CVE-2026-40046 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 and future 5.19.x releases but was missed for all 6.0.0+...

CVE-2026-40046

CVE-2026-40046 is an Integer Overflow/Wraparound vulnerability in Apache ActiveMQ and related modules (ActiveMQ, ActiveMQ All, ActiveMQ MQTT) caused by improper validation of the MQTT remaining length field. A fix intended for CVE-2025-66168 was applied only to 5.19.2+ but was missed for 6.0.0–6....

BIT-ACTIVEMQ-2026-34197 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

BIT-ACTIVEMQ-2026-33227 Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances when creating a Stomp consumer and also browsing messages in the Web console an authenticated...

CVE-2026-23903 vulnerabilities

Vulnerabilities for packages: apache-activemq, apache-activemq-fips...

GHSA-C244-P6M5-VQJ6 vulnerabilities

Vulnerabilities for packages: apache-activemq, apache-activemq-fips...

Apache ActiveMQ 输入验证错误漏洞

Apache ActiveMQ is an open-source messaging middleware developed by the Apache Foundation in the United States. It supports Java Message Service, clustering, Spring Framework, etc. There is a vulnerability in input validation of Apache ActiveMQ, which stems from improper validation of the remaini...

Exploit for CVE-2026-34197

CVE-2026-34197 — Apache ActiveMQ RCE vía Jolokia API Descr...

Exploit for CVE-2026-34197

CVE-2026-34197 CVE-2026-34197 activemq PoC PoC for the Activ...

Apache ActiveMQ Broker Jolokia MBeans Remote Code Execution Vulnerability

Apache ActiveMQ Broker is an open source message broker and integration pattern server . A security vulnerability exists in Apache ActiveMQ Broker. The vulnerability stems from the Jolokia JMX-HTTP bridge default policy that allows exec operations on MBeans, which can be exploited by an attacker ...

CVE-2026-34197

A flaw was found in Apache ActiveMQ Broker and Apache ActiveMQ. An authenticated attacker can exploit this vulnerability by sending a specially crafted discovery Uniform Resource Identifier URI to the Jolokia JMX-HTTP bridge, which is exposed on the web console. This allows the attacker to bypass...

CVE-2026-33227

A flaw was found in Apache ActiveMQ Client, Apache ActiveMQ Broker and Apache ActiveMQ All. A path traversal vulnerability, specifically an improper limitation of a pathname to a restricted directory, allows an authenticated user to manipulate input to traverse the classpath of the application,...

com.cognifide.aet:cleaner (>=2.0.0 <=3.2.2), com.cognifide.aet:communication (>=2.0.0 <=3.2.2) +125 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-web (>=5.0.0 <=5.19.2)

org.apache.activemq:activemq-web MAVEN version =5.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.3-rc1, =2.0.0, =1.1.0, =2015.12.01, =2015.12.01, =2015.12.01, =2018.9.8 - com.hi3project.vineyard:vineyard-yottacontainer =0.9.0 - com.webtide.hightide:auctiondemo =6.1H.8 -...

org.apache.activemq:activemq-osgi (>=6.0.0 <=6.2.1), org.apache.activemq:activemq-web-console (>=6.0.0 <=6.2.1) +2 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-web (>=6.0.0 <=6.2.1)

org.apache.activemq:activemq-web MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.1 Source cves: CVE-2026-33227 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-15930950...

be.yildiz-games:module-messaging-activemq (=2.0.0), com.codbex.atlas:codbex-atlas-application (>=1.1.0 <=2.110.0) +111 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-broker (>=6.0.0 <=6.2.1)

org.apache.activemq:activemq-broker MAVEN version =6.0.0, =1.1.0, =2.55.0, =1.0.5, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =1.1.0, =0.2.2, =1.4.0, =2.1.0 and more Source cves: CVE-2026-33227 Source advisory: OSV:GHSA-H2H4-5M64-M273...

com.espertech:esperio-springjms (=9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0 <=6.2.1) +5 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-all (>=6.0.0 <=6.2.1)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.1 Source cves: CVE-2026-33227 Source advisory: OSV:GHSA-H2H4-5M64-M273...

org.apache.activemq:activemq-osgi (>=6.0.0 <=6.2.1), org.apache.activemq:activemq-unit-tests (>=6.0.0 <=6.2.1) +4 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-stomp (>=6.0.0 <=6.2.1)

org.apache.activemq:activemq-stomp MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.1 - org.fcrepo:fcrepo-jms =7.0.0-RC1 - org.fcrepo:fcrepo-webapp =7.0.0-RC1 Source cves: CVE-2026-33227 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-15930951...

com.cognifide.aet:cleaner (>=2.0.0 <=3.2.2), com.cognifide.aet:communication (>=2.0.0 <=3.2.2) +175 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-stomp (>=5.10.0 <=5.19.2)

org.apache.activemq:activemq-stomp MAVEN version =5.10.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.3-rc1, =2.0.0, =3.0.0, =3.0.0, =3.0.0, =1.1.0, =1.2.4.5, =1.2.4.6, =1.2.4.5, =1.2.4.5, =1.2.6.7 and more Source cves: CVE-2026-33227 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-15930951...

org.apache.activemq:activemq-osgi (>=6.0.0 <=6.2.1), org.apache.activemq:activemq-web-console (>=6.0.0 <=6.2.1) +2 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-web (>=6.0.0 <=6.2.1)

org.apache.activemq:activemq-web MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.1 Source cves: CVE-2026-33227 Source advisory: OSV:GHSA-H2H4-5M64-M273...

com.cognifide.aet:cleaner (>=2.0.0 <=3.2.2), com.cognifide.aet:communication (>=2.0.0 <=3.2.2) +126 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-web (>=4.1.1 <=5.19.2)

org.apache.activemq:activemq-web MAVEN version =4.1.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.3-rc1, =2.0.0, =1.1.0, =2015.12.01, =2015.12.01, =2015.12.01, =6.1H.4-beta, =6.1H.4-beta, =6.1H.4-beta, =6.1H.4-beta, =6.1H.8 and more Source cves: CVE-2026-33227 Source advisory: OSV:GHSA-H2H4-5M64-M273...