Skip to content
OpenAdvisories
High WID-SEC-2026-4348 6 CVEs

Apache ActiveMQ: Mehrere Schwachstellen

Published Nov 4, 2026 · Updated Nov 4, 2026 · de-DE

Vendor: Apache Product: ActiveMQ Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren oder offenzulegen.

Product

Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.

Vulnerabilities 6

  • High 8.1
    CVE-2026-111822

    Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation

    Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change ca…

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ Runtime Config activemq Debian Ubuntu
  • High 7.5
    CVE-2026-103582

    Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)

    Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0. The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the net…

    Apache Software Foundation Apache ActiveMQ NMS OpenWire Client Library activemq Ubuntu
  • High 7.5
    CVE-2026-111821

    Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal

    Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB w…

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ KahaDB activemq Debian Ubuntu
  • Medium 6.5
    CVE-2026-108500

    Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection

    Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, back…

    Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu
  • Medium 6.5
    CVE-2026-108946

    Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection

    Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that use…

    Apache Software Foundation Apache ActiveMQ ActiveMQ Broker activemq Debian Ubuntu
  • Medium 6.5
    CVE-2026-108949

    Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM

    Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subs…

    Apache Software Foundation Apache ActiveMQ ActiveMQ Broker activemq Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References