artemis-openwire-protocol: AMQ Broker Artemis: pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo

An unauthenticated network attacker can delete arbitrary durable queues on any Apache Artemis broker with OpenWire protocol enabled default. The processRemoveSubscription method executes pre-authentication with no authorization check, and uses the internal destroyQueueSimpleString overload that...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

SUSE CVE-2026-86564

A flaw was found in DPDK lib/vhost. Missing length validation before reading commanddata in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the Openwire RemoveSubscriptionInfo command in the protocol handling. An attacker can trigger unauthorized deletion of a queue by sending a crafted command before authentication and...

Missing Authentication for Critical Function

Overview org.apache.activemq:artemis-openwire-protocol is a package for activemq. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the Openwire RemoveSubscriptionInfo command in the protocol handling. An attacker can trigger unauthorized deletio...

Missing Authentication for Critical Function

Overview org.apache.artemis:artemis-jakarta-openwire-protocol is a To support OpenWire clients from an embedded broker deployed in a Jakarta environment e.g. Spring Boot 3 Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the Openwire...

CVE-2026-49364

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

CVE-2026-49362

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

CVE-2026-67593

An unauthenticated network attacker can delete arbitrary durable queues on any Apache Artemis broker with OpenWire protocol enabled default. The processRemoveSubscription method executes pre-authentication with no authorization check, and uses the internal destroyQueueSimpleString overload that...

CVE-2026-67593

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

CVE-2026-49362

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users...

CVE-2026-49362 Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users...

CVE-2026-49362 Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users...

CVE-2026-49362

The artemis-server component in Apache Artemis (versions 2.50.0 through 2.56.0) and Apache ActiveMQ Artemis (versions 1.0.0 through 2.44.0) is vulnerable to an unauthenticated remote attack. An attacker can send CREATE_QUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary...

CVE-2026-49362 Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users...

CVE-2026-67593 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

CVE-2026-67593

An unauthenticated network attacker can delete arbitrary durable queues on an Apache Artemis broker (or Apache ActiveMQ Artemis ) with the OpenWire protocol enabled. The vulnerability exists because the processRemoveSubscription() method executes pre-authentication without authorization checks, u...

EUVD-2026-75245

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

CVE-2026-67593 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

CVE-2026-67593 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...