What’s Vulnerable › Products

Apache ActiveMQ vulnerabilities

76 known vulnerabilities, 3 confirmed exploited in the wild (CISA KEV), 27 published in the last 12 months.

Check whether your Apache ActiveMQ version is affected

Exploited Apache ActiveMQ vulnerabilities

• CVE-2026-34197 — Apache ActiveMQ Improper Input Validation Vulnerability
• CVE-2023-46604 — Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
• CVE-2016-3088 — Apache ActiveMQ Improper Input Validation Vulnerability

Latest Apache ActiveMQ vulnerabilities

• CVE-2026-74761 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId (CVSS 7.5)
• CVE-2026-61487 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations (CVSS 6.5)
• CVE-2026-59878 — Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS (CVSS 7.5)
• CVE-2026-54475 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover (CVSS 7.5)
• CVE-2026-53917 — Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling (CVSS 7.5)
• CVE-2026-53916 — Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec (CVSS 7.5)
• CVE-2026-52760 — Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console (CVSS 6.1)
• CVE-2026-50750 — Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 (CVSS 7.5)
• CVE-2026-50734 — Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation (CVSS 7.5)
• CVE-2026-49877 — Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console (CVSS 8.1)
• CVE-2026-49434 — Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker (CVSS 7.5)
• CVE-2026-49432 — Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service (CVSS 7.5)
• CVE-2026-49270 — Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) (CVSS 5.9)
• CVE-2026-49157 — Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default (CVSS 8.8)
• CVE-2026-46605 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal (CVSS 4.3)
• CVE-2026-45505 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass (CVSS 8.8)
• CVE-2026-42588 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector (CVSS 8.1)
• CVE-2026-42253 — Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties (CVSS 6.1)
• CVE-2026-41044 — Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia (CVSS 8.8)
• CVE-2026-41043 — Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues (CVSS 6.5)
• CVE-2026-40466 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI (CVSS 8.8)
• CVE-2026-39304 — Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM (CVSS 7.5)
• CVE-2026-40046 — Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated (CVSS 7.5)
• CVE-2026-34197 — Apache ActiveMQ Improper Input Validation Vulnerability (CVSS 8.8) — exploited
• CVE-2026-33227 — Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory (CVSS 4.3)