CVE-2026-39304 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, zipkin...

GHSA-H2H4-5M64-M273 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, zipkin...

GHSA-5568-6QCG-G7FX vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, zipkin...

CVE-2026-33227 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, zipkin...

GHSA-RXPJ-7QVF-XV32 vulnerabilities

Vulnerabilities for packages: geoserver, apache-activemq, apache-activemq-fips...

CVE-2026-34197 vulnerabilities

Vulnerabilities for packages: geoserver, apache-activemq, apache-activemq-fips...

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

A recently disclosed high-severity security flaw in Apache ActiveMQ Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency CISA. To that end, the agency has added the vulnerability, tracked as CVE-2026-34197 CVSS score: 8.8, to its...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-34197link is external Apache ActiveMQ Improper Input Validation Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber acto...

Apache ActiveMQ Improper Input Validation Vulnerability

Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection...

VulnCheck KEV: CVE-2026-34197

Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection...

GHSA-3PXV-7CMR-FJR4 vulnerabilities

Vulnerabilities for packages: apache-pulsar, zaproxy, apache-hop-fips, apache-activemq-artemis, kafka-bridge-fips, sonarqube, flink, apache-activemq, apache-jena-fuseki, airflow, camunda, celeborn, akhq, kafka-fips, kserve-modelmesh, wavefront-proxy, logstash, opensearch, hadoop-fips, neo4j, spar...

CVE-2026-34480 vulnerabilities

Vulnerabilities for packages: apache-pulsar, zaproxy, apache-hop-fips, apache-activemq-artemis, kafka-bridge-fips, sonarqube, flink, apache-activemq, apache-jena-fuseki, airflow, camunda, celeborn, akhq, kafka-fips, kserve-modelmesh, wavefront-proxy, logstash, opensearch, hadoop-fips, neo4j, spar...

CVE-2026-39304

A flaw was found in Apache ActiveMQ Client, Apache ActiveMQ Broker, and Apache ActiveMQ. A remote attacker can exploit this vulnerability by rapidly triggering Transport Layer Security TLS version 1.3 handshake KeyUpdates. This improper handling of KeyUpdates causes the broker to exhaust its memo...

The vulnerability of the Jolokia application programming interface of the Apache ActiveMQ messaging broker allows a perpetrator to execute arbitrary code.

The vulnerability of the Jolokia application programming interface of the Apache ActiveMQ messaging broker is related to deficiencies in the code generation management mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a configuration XML file...

CVE-2026-39304: Uncontrolled Resource Consumption

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes...

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 and future 5.19.x releases but was missed for all 6.0.0+...

CVE-2026-40046

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 and future 5.19.x releases but was missed for all 6.0.0+...

CVE-2026-23903 vulnerabilities

Vulnerabilities for packages: apache-activemq, apache-activemq-fips...

GHSA-C244-P6M5-VQJ6 vulnerabilities

Vulnerabilities for packages: apache-activemq, apache-activemq-fips...

CVE-2026-40046: Integer Overflow or Wraparound

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 and future 5.19.x releases but was missed for all 6.0.0+...