CLSA-2026-1793195078 TuxCare security update for org.apache.activemq (5 CVEs)

TuxCare rebuilt 5 org.apache.activemq packages to address 5 CVEs. Fixed in 2.37.0-tuxcare.3...

CLSA-2026-1791377217 TuxCare security update for org.apache.activemq (3 CVEs)

TuxCare rebuilt 4 org.apache.activemq packages to address 3 CVEs. Fixed in 2.33.0-tuxcare.7...

PT-2026-116421

TuxCare rebuilt 55 org.apache.activemq packages to address 3 CVEs. Fixed in 2.33.0-tuxcare.7...

com.atomikos:transactions-spring-boot-integration-tests (>=5.0.9, <=6.0.1), com.atomikos:transactions-spring-boot3-integration-tests (>=6.0.0m1, <=6.0.1) +231 more potentially affected by CVE-2026-57967 via org.apache.activemq:artemis-server (>=1.0.0, <=2.54.0)

org.apache.activemq:artemis-server MAVEN version =1.0.0, =5.0.9, =6.0.0m1, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =0.37, =0.43, =0.22, =0.22, =0.22, =0.22, =0.3, =0.9 and more Source cves: CVE-2026-57967 Source advisory: MEND:CVE-2026-57967...

CLSA-2026-1786943805 TuxCare security update for org.apache.activemq:artemis-server (1 CVE)

TuxCare rebuilt org.apache.activemq:artemis-server to address 1 CVE. Fixed in 2.37.0-tuxcare.1...

PT-2026-82437

TuxCare rebuilt 55 org.apache.activemq packages to address 1 CVE. Fixed in 2.37.0-tuxcare.1...

PT-2026-74433

TuxCare rebuilt 55 org.apache.activemq packages to address 2 CVEs. Fixed in 2.33.0-tuxcare.1...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1151 more potentially affected by CVE-2026-61487 via org.apache.activemq:activemq-broker (>=5.8.0, <=5.19.8)

org.apache.activemq:activemq-broker MAVEN version =5.8.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2026-61487 Source advisory:...

Apache ActiveMQ CVE-2026-34197 Jolokia RCE

CVE-2026-34197: authenticated Jolokia exec on org.apache.activemq MBeans allows addNetworkConnector with a crafted vm:// URI that loads remote Spring XML xbean:http://ATTACKER/shell.xml for arbitrary code execution. This module serves shell.xml with an inline base64 JSP webshell, then invokes the...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1511 more potentially affected by CVE-2026-53917 via org.apache.activemq:activemq-client (>=5.8.0, <=5.19.7)

org.apache.activemq:activemq-client MAVEN version =5.8.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2026-53917 Source advisory:...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1151 more potentially affected by CVE-2026-54475 via org.apache.activemq:activemq-broker (>=5.8.0, <=5.19.7)

org.apache.activemq:activemq-broker MAVEN version =5.8.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2026-54475 Source advisory:...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1151 more potentially affected by CVE-2026-49270 via org.apache.activemq:activemq-broker (>=5.8.0, <=5.19.6)

org.apache.activemq:activemq-broker MAVEN version =5.8.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2026-49270 Source advisory:...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1151 more potentially affected by CVE-2026-33227 via org.apache.activemq:activemq-broker (>=5.8.0, <=5.19.2)

org.apache.activemq:activemq-broker MAVEN version =5.8.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2026-33227 Source advisory: GHSA-H2H4-5M64-M273...

Deserialization Of Untrusted Data

org.apache.activemq is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to org.jolokia.http.HttpRequestHandlerhandlePostRequest creating a JmxRequest through a JSONObject and calls to org.jolokia.http.HttpRequestHandlerexecuteRequest. This issue can be exploited by an...

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms...

Debian DLA-2179-1 : jackson-databind security update

Following CVEs were reported against the jackson-databind source package : CVE-2020-10968 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider aka bus-proxy. CVE-2020-10969...

CVE-2020-11111

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms...

CVE-2020-11111

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms...

Design/Logic Flaw

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms...

CVE-2020-11111

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms...