org.apache.activemq:artemis-features (>=2.31.1, <=2.33.0) potentially affected by CVE-2026-101292 via org.apache.activemq:artemis-core-client-osgi (>=2.31.1, <=2.33.0)

org.apache.activemq:artemis-core-client-osgi MAVEN version =2.31.1, =2.31.1, =2.33.0 Source cves: CVE-2026-101292 Source advisory: MEND:CVE-2026-101292...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

Important: Red Hat Security Advisory: AMQ Clients 2026.Q3

An update is now available for Red Hat AMQ Clients Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the Referenc...

Deserialization of Untrusted Data

Overview org.apache.activemq:artemis-core-client is a High-performance, non-blocking architecture for the next generation of event-driven messaging applications. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the parameter processing of message-based...

biz.eyebeam.mssc:mssc-public-bom (>=1.0.1, <=1.0.12), br.com.faroltech:mssc-brewery-bom (>=1.0.3, <=1.0.5) +989 more potentially affected by CVE-2026-57822 via org.apache.activemq:artemis-core-client (>=1.3.0, <=2.53.0)

org.apache.activemq:artemis-core-client MAVEN version =1.3.0, =1.0.1, =1.0.3, =5.0.9, =6.0.0m1, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =1.0.3, =1.0.7364, =1.6, =1.1, =1.2 and more Source cves: CVE-2026-57822 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-20186821...

Missing Authentication for Critical Function

Overview org.apache.activemq:artemis-core-client is a High-performance, non-blocking architecture for the next generation of event-driven messaging applications. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the initial cluster connection...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the initial cluster connection handshake. An attacker can obtain administrative credentials by capturing network traffic during the handshake. Remediation Upgrade...

Insertion of Sensitive Information into Log File

Overview org.apache.activemq:artemis-core-client is a High-performance, non-blocking architecture for the next generation of event-driven messaging applications. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when the ConfigurationImpl logger ...

biz.eyebeam.mssc:mssc-public-bom (>=1.0.1, <=1.0.12), br.com.faroltech:mssc-brewery-bom (>=1.0.3, <=1.0.5) +960 more potentially affected by CVE-2025-27391 via org.apache.activemq:artemis-core-client (>=1.5.1, <=2.39.0)

org.apache.activemq:artemis-core-client MAVEN version =1.5.1, =1.0.1, =1.0.3, =5.0.9, =6.0.0m1, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =1.0.3, =1.0.7364, =1.6, =1.1, =0.1.19, =0.2.5 and more Source cves: CVE-2025-27391 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-9689863...

Denial Of Service (DoS)

artemis-core-client is vulnerable to denial of service. The vulnerability exists due to the Out of memory OOM condition in the encodeXid function of XidCodecSupport.java as the function does not properly encode the reading data, allowing an attacker to crash the application by providing a...

io.fabric8.ipaas.apps:artemis (>=2.2.94, <=2.2.96), io.fabric8.ipaas.apps:fabric8-msm (>=2.2.90, <=2.2.96) +128 more potentially affected by CVE-2021-4040 via org.apache.activemq:artemis-core-client (1.2.0)

org.apache.activemq:artemis-core-client MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-core-client and may be impacted: - io.fabric8.ipaas.apps:artemis =2.2.94, =2.2.90, =2.2.97, =2.2.97, =2.2.94, =2.2.9...

com.kloudtek.ktspring:ktspring-artemis (1.0), com.kloudtek.ktspring:ktspring-standalone-artemis-hibernate (1.0) +132 more potentially affected by CVE-2021-4040 via org.apache.activemq:artemis-core-client (1.5.0)

org.apache.activemq:artemis-core-client MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-core-client and may be impacted: - com.kloudtek.ktspring:ktspring-artemis 1.0 -...

me.snowdrop:spring-cloud-starter-stream-artemis (0.0.1), me.snowdrop:spring-cloud-stream-binder-artemis (0.0.1) +127 more potentially affected by CVE-2021-4040 via org.apache.activemq:artemis-core-client (1.5.6)

org.apache.activemq:artemis-core-client MAVEN version 1.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-core-client and may be impacted: - me.snowdrop:spring-cloud-starter-stream-artemis 0.0.1 -...

org.apache.activemq.examples.amqp:protoncpp (1.5.2), org.apache.activemq.examples.broker:artemis-cdi-example (1.5.2) +124 more potentially affected by CVE-2021-4040 via org.apache.activemq:artemis-core-client (1.5.2)

org.apache.activemq:artemis-core-client MAVEN version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-core-client and may be impacted: - org.apache.activemq.examples.amqp:protoncpp 1.5.2 -...

biz.eyebeam.mssc:mssc-public-bom (>=1.0.1, <=1.0.5), br.com.faroltech:mssc-brewery-bom (>=1.0.3, <=1.0.5) +906 more potentially affected by CVE-2021-4040 via org.apache.activemq:artemis-core-client (>=1.0.0, <=2.19.0)

org.apache.activemq:artemis-core-client MAVEN version =1.0.0, =1.0.1, =1.0.3, =5.0.9, =1.0.3, =1.6, =1.1, =0.37, =0.43, =0.17, =0.17, =0.17, =0.17, =0.17, =0.3, =0.9 and more Source cves: CVE-2021-4040 Source advisory: MEND:CVE-2021-4040...

org.apache.activemq.examples.amqp:protoncpp (1.4.0), org.apache.activemq.examples.broker:auto-closeable (1.4.0) +121 more potentially affected by CVE-2022-23913 via org.apache.activemq:artemis-core-client (1.4.0)

org.apache.activemq:artemis-core-client MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-core-client and may be impacted: - org.apache.activemq.examples.amqp:protoncpp 1.4.0 -...

org.apache.activemq.examples.amqp:protoncpp (1.5.4), org.apache.activemq.examples.broker:artemis-cdi-example (1.5.4) +131 more potentially affected by CVE-2022-23913 via org.apache.activemq:artemis-core-client (1.5.4)

org.apache.activemq:artemis-core-client MAVEN version 1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-core-client and may be impacted: - org.apache.activemq.examples.amqp:protoncpp 1.5.4 -...

org.apache.activemq.examples.core:artemis-core-embedded-example (1.0.0), org.apache.activemq.examples.core:artemis-core-embedded-remote-example (1.0.0) +119 more potentially affected by CVE-2022-23913 via org.apache.activemq:artemis-core-client (1.0.0)

org.apache.activemq:artemis-core-client MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-core-client and may be impacted: - org.apache.activemq.examples.core:artemis-core-embedded-example 1.0.0 -...

com.kloudtek.ktspring:ktspring-artemis (1.0), com.kloudtek.ktspring:ktspring-standalone-artemis-hibernate (1.0) +132 more potentially affected by CVE-2022-23913 via org.apache.activemq:artemis-core-client (1.5.0)

org.apache.activemq:artemis-core-client MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-core-client and may be impacted: - com.kloudtek.ktspring:ktspring-artemis 1.0 -...