Skip to content
OpenAdvisories

Package · Debian

activemq

50 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.1
    CVE-2026-42588 Public exploit

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console…

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
  • High 8.8
    CVE-2026-41044 Public exploit

    Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker na…

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
  • High 8.8
    CVE-2026-34197 Exploited Public exploit EPSS 98%

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia…

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
    KEV Apr 16, 2026
  • High 8.8
    CVE-2022-41678 Public exploit EPSS 86%

    Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

    Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePos…

    Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  • High 7.5
    CVE-2019-0222 Public exploit EPSS 12%

    Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client

    In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

    Apache Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  • High 7.5
    CVE-2014-3576 Public exploit EPSS 13%

    Improper Neutralization of Special Elements used in an OS Command in Apache ActiveMQ

    The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.

    activemq activemq org.apache.activemq:activemq-client Debian Ubuntu Maven