160 matches found
PT-2026-89274
Name of the Vulnerable Software and Affected Versions Apache Artemis versions 2.50.0 through 2.56.0 Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 Description An authenticated client can attach a consumer using a selector with crafted wildcard usage. This causes excessive evaluation during...
CVE-2026-49364: Missing Authentication for Critical Function
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommend...
PT-2026-109364
Уязвимость асинхронных систем обмена сообщениями Apache ActiveMQ Artemis и Apache Artemis связана с отсутствием аутентификации для критичной функции. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить полный контроль над приложением...
PT-2026-89272
Name of the Vulnerable Software and Affected Versions Apache Artemis versions 2.50.0 through 2.56.0 Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 Description An unauthenticated remote attacker can craft a CORE protocol SESSION REATTACH packet to hijack a live authenticated session. This...
org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation...
org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation...
org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation...
org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation...
Improper Authorization
Apache Artemis is vulnerable to Improper Authorization. The vulnerability is due to insufficient permission checks when handling STOMP routing types, which allows users with only send or consume permissions to modify or augment an address's routing type without the required createAddress permissi...
K000162017: Apache Artemis vulnerability CVE-2026-27446
Security Advisory Description Missing Authentication for Critical Function CWE-306 vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an...
CVE-2026-40914
A flaw was found in Apache ActiveMQ Artemis STOMP. An authenticated user with send or consume permission on an address can change that address's routing-type even without createAddress. As a result, send or consume operations that should be rejected for an unsupported routing-type may succeed,...
Apache Artemis 2.0.0 < 2.54.0 Incorrect Authorization (CVE-2026-40914)
The version of Apache Artemis formerly Apache ActiveMQ Artemis installed on the remote host is affected by a vulnerability: - A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an...
Apache Artemis has an Incorrect Authorization issue
A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for...
org.apache.artemis:apache-artemis (>=2.50.0, <=2.53.0), org.apache.artemis:artemis-features (>=2.50.0, <=2.53.0) +5 more potentially affected by CVE-2026-40914 via org.apache.artemis:artemis-stomp-protocol (>=2.50.0, <=2.53.0)
org.apache.artemis:artemis-stomp-protocol MAVEN version =2.50.0, =2.50.0, =2.50.0, =2.50.0, =40.0.0.beta1, =40.0.0.beta1, =40.0.0.beta1, =40.0.0.beta1, =40.0.1.final Source cves: CVE-2026-40914 Source advisory: GHSA-RF99-F9J2-GV3F...
GHSA-RF99-F9J2-GV3F Apache Artemis has an Incorrect Authorization issue
A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for...
org.apache.artemis:apache-artemis (>=2.50.0, <=2.53.0), org.apache.artemis:artemis-features (>=2.50.0, <=2.53.0) +5 more potentially affected by CVE-2026-40914 via org.apache.artemis:artemis-stomp-protocol (>=2.50.0, <=2.53.0)
org.apache.artemis:artemis-stomp-protocol MAVEN version =2.50.0, =2.50.0, =2.50.0, =2.50.0, =40.0.0.beta1, =40.0.0.beta1, =40.0.0.beta1, =40.0.0.beta1, =40.0.1.final Source cves: CVE-2026-40914 Source advisory: OSV:GHSA-RF99-F9J2-GV3F...
com.io7m.jsay:com.io7m.jsay (>=0.0.1, <=1.0.0), com.jkoolcloud.tnt4j.streams:tnt4j-streams-jms (>=1.14.2, <=2.3.0) +10 more potentially affected by CVE-2026-40914 via org.apache.activemq:artemis-stomp-protocol (>=2.0.0, <=2.44.0)
org.apache.activemq:artemis-stomp-protocol MAVEN version =2.0.0, =0.0.1, =1.14.2, =4.2.8, =2.0.0, =2.0.0, =2.31.1, =2.29.0, =28.0.0.beta1, =29.0.0.alpha1, =28.0.0.beta1, =28.0.0.beta1, =39.0.1.final Source cves: CVE-2026-40914 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-17116517...
org.apache.artemis:apache-artemis (>=2.50.0, <=2.53.0), org.apache.artemis:artemis-features (>=2.50.0, <=2.53.0) +5 more potentially affected by CVE-2026-40914 via org.apache.artemis:artemis-stomp-protocol (>=2.50.0, <=2.53.0)
org.apache.artemis:artemis-stomp-protocol MAVEN version =2.50.0, =2.50.0, =2.50.0, =2.50.0, =40.0.0.beta1, =40.0.0.beta1, =40.0.0.beta1, =40.0.0.beta1, =40.0.1.final Source cves: CVE-2026-40914 Source advisory: SNYK:JAVA-ORGAPACHEARTEMIS-17116516...
org.apache.artemis:apache-artemis (>=2.50.0, <=2.53.0), org.apache.artemis:artemis-features (>=2.50.0, <=2.53.0) +5 more potentially affected by CVE-2026-40914 via org.apache.artemis:artemis-stomp-protocol (>=2.50.0, <=2.53.0)
org.apache.artemis:artemis-stomp-protocol MAVEN version =2.50.0, =2.50.0, =2.50.0, =2.50.0, =40.0.0.beta1, =40.0.0.beta1, =40.0.0.beta1, =40.0.0.beta1, =40.0.1.final Source cves: CVE-2026-40914 Source advisory: MEND:CVE-2026-40914...
CVE-2026-40914 Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission
A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for...