Skip to content
OpenAdvisories

Package · Maven

org.apache.activemq:activemq-client

20 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.9
    CVE-2025-27533 Public exploit

    Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

    Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of …

    Apache Software Foundation Apache ActiveMQ zipkin zipkin-slim Debian Ubuntu Wolfi Maven
  • Critical 10.0
    CVE-2023-46604 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

    The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class …

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ Legacy OpenWire Module activemq Debian Ubuntu Maven
    KEV Nov 2, 2023
  • High 7.5
    CVE-2019-0222 Public exploit EPSS 12%

    Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client

    In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

    Apache Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  • Critical 9.8
    CVE-2016-3088 Exploited Public exploit Scanner template EPSS 98%

    Improper Input Validation in Apache ActiveMQ

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

    activemq activemq org.apache.activemq:activemq-client Debian Ubuntu Maven
    KEV Feb 10, 2022
  • Critical 9.8
    CVE-2015-5254 Public exploit EPSS 38%

    Improper Input Validation in Apache ActiveMQ

    Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

    activemq activemq org.apache.activemq:activemq-client Debian Ubuntu Maven
  • Medium —
    CVE-2015-1830 Public exploit EPSS 84%

    Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ

    Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

    org.apache.activemq:activemq-client Maven
  • High 7.5
    CVE-2014-3576 Public exploit EPSS 13%

    Improper Neutralization of Special Elements used in an OS Command in Apache ActiveMQ

    The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.

    activemq activemq org.apache.activemq:activemq-client Debian Ubuntu Maven
  • Medium —
    CVE-2014-8110 Public exploit

    Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ

    Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    org.apache.activemq:activemq-client Maven