Vulnerability-Lookup

CVE-2026-33227 (GCVE-0-2026-33227)

Vulnerability from cvelistv5 – Published: 2026-04-07 07:50 – Updated: 2026-04-08 15:44

Title

Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory

Summary

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-07 14:04 UTC

CWE

CWE-22 - Improper input validation for resource loading

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1085 records in the last 180 days details

References

2 references

URL	Tags
https://activemq.apache.org/security-advisories.d…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/04/06/4

Impacted products

5 products

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache ActiveMQ Client	Affected: 0 , < 5.19.3 (semver) Affected: 6.0.0 , < 6.2.2 (semver)	guessed
Apache Software Foundation	Apache ActiveMQ Broker	Affected: 0 , < 5.19.3 (semver) Affected: 6.0.0 , < 6.2.2 (semver)	guessed
Apache Software Foundation	Apache ActiveMQ All	Affected: 0 , < 5.19.3 (semver) Affected: 6.0.0 , < 6.2.2 (semver)	guessed
Apache Software Foundation	Apache ActiveMQ Web	Affected: 0 , < 5.19.3 (semver) Affected: 6.0.0 , < 6.2.2 (semver)	guessed
Apache Software Foundation	Apache ActiveMQ	Affected: 0 , < 5.19.3 (semver) Affected: 6.0.0 , < 6.2.2 (semver)	guessed

Credits

Dawei Wang

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-07T08:29:12.768Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/06/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-33227",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T14:04:21.706397Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T14:05:29.211Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-client",
          "product": "Apache ActiveMQ Client",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-broker",
          "product": "Apache ActiveMQ Broker",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-all",
          "product": "Apache ActiveMQ All",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-web",
          "product": "Apache ActiveMQ Web",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:apache-activemq",
          "product": "Apache ActiveMQ",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.2",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dawei Wang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper validation and restriction of a classpath path name vulnerability in \n\n Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.\n\n\u003cbr\u003e\u003cbr\u003eIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided \"key\" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eThis issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.\u003c/p\u003eUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Improper validation and restriction of a classpath path name vulnerability in \n\n Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.\n\n\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided \"key\" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit.\n\n\n\n\n\nThis issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper input validation for resource loading",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T15:44:39.427Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-33227-announcement.txt"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-33227",
    "datePublished": "2026-04-07T07:50:58.897Z",
    "dateReserved": "2026-03-18T00:08:09.668Z",
    "dateUpdated": "2026-04-08T15:44:39.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33227",
      "date": "2026-10-28",
      "epss": "0.00419",
      "percentile": "0.361"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.activemq:activemq-client",
                "product": "Apache ActiveMQ Client",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "5.19.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2.2",
                    "status": "affected",
                    "version": "6.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.activemq:activemq-broker",
                "product": "Apache ActiveMQ Broker",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "5.19.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2.2",
                    "status": "affected",
                    "version": "6.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.activemq:activemq-all",
                "product": "Apache ActiveMQ All",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "5.19.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2.2",
                    "status": "affected",
                    "version": "6.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.activemq:activemq-web",
                "product": "Apache ActiveMQ Web",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "5.19.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2.2",
                    "status": "affected",
                    "version": "6.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.activemq:apache-activemq",
                "product": "Apache ActiveMQ",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "5.19.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2.2",
                    "status": "affected",
                    "version": "6.0.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7442A37C-AACC-4BF1-8AB7-1B4FBDE44CB4",
                    "versionEndExcluding": "5.19.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "313BB84A-138D-43C8-B265-F789A4BED361",
                    "versionEndExcluding": "6.2.2",
                    "versionStartIncluding": "6.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4342B2A-3F2C-4016-87FB-66D69685FEA0",
                    "versionEndExcluding": "5.19.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "97120890-1D2D-4021-BF6D-362CEB57E13B",
                    "versionEndExcluding": "6.2.2",
                    "versionStartIncluding": "6.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0489A0FD-BF30-47A7-8AB7-19260119ABF1",
                    "versionEndExcluding": "5.19.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:activemq_web:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EF252D19-2B2F-41ED-A2D6-1C4AC2CDCF37",
                    "versionEndExcluding": "6.2.2",
                    "versionStartIncluding": "6.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper validation and restriction of a classpath path name vulnerability in \n\n Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.\n\n\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided \"key\" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit.\n\n\n\n\n\nThis issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3."
          },
          {
            "lang": "es",
            "value": "Validaci\u00f3n y restricci\u00f3n inadecuadas de una vulnerabilidad de nombre de ruta de classpath en Apache ActiveMQ Cliente, Apache ActiveMQ Broker, Apache ActiveMQ All.\n\nEn dos instancias (al crear un consumidor Stomp y tambi\u00e9n al navegar por mensajes en la consola web), un valor de \u2019key\u2019 proporcionado por un usuario autenticado podr\u00eda construirse para recorrer el classpath debido a la concatenaci\u00f3n de rutas. Como resultado, la aplicaci\u00f3n est\u00e1 expuesta a una vulnerabilidad de carga de recursos de ruta de classpath que podr\u00eda encadenarse con otro ataque para conducir a un exploit. Este problema afecta a Apache ActiveMQ Cliente: anterior a 5.19.3, desde 6.0.0 anterior a 6.2.2; Apache ActiveMQ Broker: anterior a 5.19.3, desde 6.0.0 anterior a 6.2.2; Apache ActiveMQ All: anterior a 5.19.3, desde 6.0.0 anterior a 6.2.2.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 5.19.4 o 6.2.3, que corrige el problema. Nota: 5.19.3 y 6.2.2 tambi\u00e9n corrigen este problema, pero eso est\u00e1 limitado a entornos que no son Windows debido a un error de resoluci\u00f3n de separador de ruta corregido en 5.19.4 y 6.2.3."
          }
        ],
        "id": "CVE-2026-33227",
        "lastModified": "2026-10-26T22:10:00.163",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-33227",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T14:04:21.706397Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-07T09:16:20.750",
        "references": [
          {
            "source": "security@apache.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-33227-announcement.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2026/04/06/4"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security@apache.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T19:37:55+00:00",
      "cve": "CVE-2026-33227",
      "id": "CVE-2026-33227",
      "initial_release_date": "2026-04-07T07:50:58.897000+00:00",
      "product_status:known_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "org.apache.activemq/activemq-client: org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/activemq-web: improper limitation of a pathname to a restricted classpath directory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33227.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-04-07T08:29:12.768Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2026/04/06/4"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 4.3,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-33227",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-07T14:04:21.706397Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-07T14:03:27.404Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.activemq:activemq-client",
              "product": "Apache ActiveMQ Client",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThan": "5.19.3",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.2.2",
                  "status": "affected",
                  "version": "6.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.activemq:activemq-broker",
              "product": "Apache ActiveMQ Broker",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThan": "5.19.3",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.2.2",
                  "status": "affected",
                  "version": "6.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.activemq:activemq-all",
              "product": "Apache ActiveMQ All",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThan": "5.19.3",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.2.2",
                  "status": "affected",
                  "version": "6.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.activemq:activemq-web",
              "product": "Apache ActiveMQ Web",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThan": "5.19.3",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.2.2",
                  "status": "affected",
                  "version": "6.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.activemq:apache-activemq",
              "product": "Apache ActiveMQ",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThan": "5.19.3",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.2.2",
                  "status": "affected",
                  "version": "6.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Dawei Wang"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eImproper validation and restriction of a classpath path name vulnerability in \n\n Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.\n\n\u003cbr\u003e\u003cbr\u003eIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided \"key\" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eThis issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.\u003c/p\u003eUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
                }
              ],
              "value": "Improper validation and restriction of a classpath path name vulnerability in \n\n Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.\n\n\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided \"key\" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit.\n\n\n\n\n\nThis issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "text": "low"
                },
                "type": "Textual description of severity"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22 Improper input validation for resource loading",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-08T15:44:39.427Z",
            "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            "shortName": "apache"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-33227-announcement.txt"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "assignerShortName": "apache",
        "cveId": "CVE-2026-33227",
        "datePublished": "2026-04-07T07:50:58.897Z",
        "dateReserved": "2026-03-18T00:08:09.668Z",
        "dateUpdated": "2026-04-08T15:44:39.427Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

OESA-2026-2126 (CVE-2026-33227)

Vulnerability from osv_openeuler – Published: 2026-05-03 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

activemq security update

Details

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

"Severity: important \n\nAffected versions:\n\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.4\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.3\n\nDescription:\n\nImproper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ \nBroker, Apache ActiveMQ.\n\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at\xa0/api/jolokia/ on the web console. The default Jolokia \naccess policy permits\xa0exec operations on all ActiveMQ\xa0MBeans (org.apache.activemq:*), including\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). \n\nAn authenticated attacker can\xa0invoke these operations with a crafted discovery URI that triggers the VM\xa0transport's \nbrokerConfig parameter to load a remote Spring XML application\xa0context using ResourceXmlApplicationContext. \nBecause Spring's\xa0ResourceXmlApplicationContext instantiates all singleton beans before the\xa0BrokerService validates the \nconfiguration, arbitrary code execution occurs\xa0on the broker's JVM through bean factory methods such as Runtime.exec().\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .\n\nUsers are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n\nCredit:\n\nNaveen Sunkavally (Horizon3.ai) (finder)\n\nReferences:"

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.(CVE-2026-39304)

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions. This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.(CVE-2026-40046)

A vulnerability, which was classified as problematic, has been found in Apache ActiveMQ up to 5.19.5/6.2.4 (Application Server Software).Impacted is integrity.Upgrading to version 5.19.6 or 6.2.5 eliminates this vulnerability.(CVE-2026-40466)

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.

This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.(CVE-2026-41043)

A vulnerability has been found in Apache ActiveMQ up to 5.19.5/6.2.4 and classified as problematic. As an impact it is known to affect confidentiality, integrity, and availability. Upgrading to version 5.19.6 or 6.2.5 eliminates this vulnerability.(CVE-2026-41044)

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-33227	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-34197	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-39304	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40046	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40466	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-41043	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-41044	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "noarch": [
          "activemq-5.19.6-1.oe2403sp1.noarch.rpm",
          "activemq-javadoc-5.19.6-1.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "activemq-5.19.6-1.oe2403sp1.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "activemq",
        "purl": "pkg:rpm/openEuler/activemq\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.19.6-1.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The most popular and powerful open source messaging and Integration Patterns server.\r\n\r\nSecurity Fix(es):\n\n[\u0026apos;Severity: low \\n\\nAffected versions:\\n\\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.3\\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.2\\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.3\\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.2\\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.3\\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.2\\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.3\\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.2\\n\\nDescription:\\n\\nImproper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ \\nBroker, Apache ActiveMQ All.\\n\\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user \\nprovided \u0026quot;key\u0026quot; value could be constructed to traverse the classpath due to path concatenation. As a result, the \\napplication is exposed to a classpath path resource loading vulnerability that could potentially be chained together \\nwith another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before \\n6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 \\nbefore 6.2.2.\\n\\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix \\nthis issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and \\n6.2.3.\\n\\nCredit:\\n\\nDawei Wang (finder)\\n\\nReferences:\u0026apos;](CVE-2026-33227)\n\n[\u0026quot;Severity: important \\n\\nAffected versions:\\n\\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4\\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.3\\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.4\\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.3\\n\\nDescription:\\n\\nImproper Input Validation, Improper Control of Generation of Code (\u0026apos;Code Injection\u0026apos;) vulnerability in Apache ActiveMQ \\nBroker, Apache ActiveMQ.\\n\\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at\\xa0/api/jolokia/ on the web console. The default Jolokia \\naccess policy permits\\xa0exec operations on all ActiveMQ\\xa0MBeans (org.apache.activemq:*), including\\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). \\n\\nAn authenticated attacker can\\xa0invoke these operations with a crafted discovery URI that triggers the VM\\xa0transport\u0026apos;s \\nbrokerConfig parameter to load a remote Spring XML application\\xa0context using ResourceXmlApplicationContext. \\nBecause Spring\u0026apos;s\\xa0ResourceXmlApplicationContext instantiates all singleton beans before the\\xa0BrokerService validates the \\nconfiguration, arbitrary code execution occurs\\xa0on the broker\u0026apos;s JVM through bean factory methods such as Runtime.exec().\\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .\\n\\nUsers are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\\n\\nCredit:\\n\\nNaveen Sunkavally (Horizon3.ai) (finder)\\n\\nReferences:\u0026quot;](CVE-2026-34197)\n\nDenial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.\n\nActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.\n\nNote: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well.\nThis issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.\n\nUsers are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.(CVE-2026-39304)\n\nInteger Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for \u0026quot;CVE-2025-66168: MQTT control packet remaining length field is not properly validated\u0026quot; was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions. This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.(CVE-2026-40046)\n\nA vulnerability, which was classified as problematic, has been found in Apache ActiveMQ up to 5.19.5/6.2.4 (Application Server Software).Impacted is integrity.Upgrading to version 5.19.6 or 6.2.5 eliminates this vulnerability.(CVE-2026-40466)\n\nImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\n\nAn authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.\n\nThis issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.(CVE-2026-41043)\n\nA vulnerability has been found in Apache ActiveMQ up to 5.19.5/6.2.4 and classified as problematic. As an impact it is known to affect confidentiality, integrity, and availability. Upgrading to version 5.19.6 or 6.2.5 eliminates this vulnerability.(CVE-2026-41044)",
  "id": "OESA-2026-2126",
  "modified": "2026-08-06T11:11:07Z",
  "published": "2026-05-03T11:11:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2126"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33227"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34197"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39304"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40046"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40466"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41043"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41044"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "activemq security update",
  "upstream": [
    "CVE-2026-33227",
    "CVE-2026-34197",
    "CVE-2026-39304",
    "CVE-2026-40046",
    "CVE-2026-40466",
    "CVE-2026-41043",
    "CVE-2026-41044"
  ]
}

OESA-2026-2127 (CVE-2026-33227)

Vulnerability from osv_openeuler – Published: 2026-05-03 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

activemq security update

Details

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.(CVE-2026-39304)

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.(CVE-2026-41043)

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-33227	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-34197	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-39304	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40046	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40466	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-41043	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-41044	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "noarch": [
          "activemq-5.19.6-1.oe2403sp3.noarch.rpm",
          "activemq-javadoc-5.19.6-1.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "activemq-5.19.6-1.oe2403sp3.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "activemq",
        "purl": "pkg:rpm/openEuler/activemq\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.19.6-1.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The most popular and powerful open source messaging and Integration Patterns server.\r\n\r\nSecurity Fix(es):\n\n[\u0026apos;Severity: low \\n\\nAffected versions:\\n\\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.3\\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.2\\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.3\\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.2\\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.3\\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.2\\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.3\\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.2\\n\\nDescription:\\n\\nImproper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ \\nBroker, Apache ActiveMQ All.\\n\\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user \\nprovided \u0026quot;key\u0026quot; value could be constructed to traverse the classpath due to path concatenation. As a result, the \\napplication is exposed to a classpath path resource loading vulnerability that could potentially be chained together \\nwith another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before \\n6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 \\nbefore 6.2.2.\\n\\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix \\nthis issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and \\n6.2.3.\\n\\nCredit:\\n\\nDawei Wang (finder)\\n\\nReferences:\u0026apos;](CVE-2026-33227)\n\n[\u0026quot;Severity: important \\n\\nAffected versions:\\n\\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4\\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.3\\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.4\\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.3\\n\\nDescription:\\n\\nImproper Input Validation, Improper Control of Generation of Code (\u0026apos;Code Injection\u0026apos;) vulnerability in Apache ActiveMQ \\nBroker, Apache ActiveMQ.\\n\\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at\\xa0/api/jolokia/ on the web console. The default Jolokia \\naccess policy permits\\xa0exec operations on all ActiveMQ\\xa0MBeans (org.apache.activemq:*), including\\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). \\n\\nAn authenticated attacker can\\xa0invoke these operations with a crafted discovery URI that triggers the VM\\xa0transport\u0026apos;s \\nbrokerConfig parameter to load a remote Spring XML application\\xa0context using ResourceXmlApplicationContext. \\nBecause Spring\u0026apos;s\\xa0ResourceXmlApplicationContext instantiates all singleton beans before the\\xa0BrokerService validates the \\nconfiguration, arbitrary code execution occurs\\xa0on the broker\u0026apos;s JVM through bean factory methods such as Runtime.exec().\\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .\\n\\nUsers are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\\n\\nCredit:\\n\\nNaveen Sunkavally (Horizon3.ai) (finder)\\n\\nReferences:\u0026quot;](CVE-2026-34197)\n\nDenial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.\n\nActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.\n\nNote: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well.\nThis issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.\n\nUsers are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.(CVE-2026-39304)\n\nInteger Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for \u0026quot;CVE-2025-66168: MQTT control packet remaining length field is not properly validated\u0026quot; was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions. This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.(CVE-2026-40046)\n\nA vulnerability, which was classified as problematic, has been found in Apache ActiveMQ up to 5.19.5/6.2.4 (Application Server Software).Impacted is integrity.Upgrading to version 5.19.6 or 6.2.5 eliminates this vulnerability.(CVE-2026-40466)\n\nImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.\n\nAn authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.\n\nThis issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.(CVE-2026-41043)\n\nA vulnerability has been found in Apache ActiveMQ up to 5.19.5/6.2.4 and classified as problematic. As an impact it is known to affect confidentiality, integrity, and availability. Upgrading to version 5.19.6 or 6.2.5 eliminates this vulnerability.(CVE-2026-41044)",
  "id": "OESA-2026-2127",
  "modified": "2026-08-06T11:11:07Z",
  "published": "2026-05-03T11:11:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2127"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33227"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34197"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39304"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40046"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40466"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41043"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41044"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "activemq security update",
  "upstream": [
    "CVE-2026-33227",
    "CVE-2026-34197",
    "CVE-2026-39304",
    "CVE-2026-40046",
    "CVE-2026-40466",
    "CVE-2026-41043",
    "CVE-2026-41044"
  ]
}

UBUNTU-CVE-2026-33227 (CVE-2026-33227)

Vulnerability from osv_ubuntu – Published: 2026-04-07 09:16 – Updated: 2026-10-17 09:40 – Source website

Details

Severity

4.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-33227	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-33227	REPORT
	https://activemq.apache.org/security-advisories.d…	REPORT
	http://www.openwall.com/lists/oss-security/2026/04/06/4	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.13.2+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.13.2+dfsg-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.13.2+dfsg-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.6.0+dfsg1-4+deb8u1ubuntu1",
        "5.6.0+dfsg1-5",
        "5.13.2+dfsg-2",
        "5.13.2+dfsg-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.15.8-2~18.04.1~esm1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.15.8-2~18.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.15.8-2~18.04.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.14.5-3",
        "5.15.2-2",
        "5.15.3-2",
        "5.15.8-2~18.04",
        "5.15.8-2~18.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.15.11-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.15.11-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.15.11-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.15.10-1",
        "5.15.11-1",
        "5.15.11-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.16.1-1ubuntu0.1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.16.1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.16.1-1ubuntu0.1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.16.1-1",
        "5.16.1-1ubuntu0.1~esm1",
        "5.16.1-1ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.17.6+dfsg-1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.17.6+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.17.6+dfsg-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.17.2+dfsg-2",
        "5.17.6+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.17.6+dfsg-2"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.17.6+dfsg-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.17.6+dfsg-2?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.17.6+dfsg-1",
        "5.17.6+dfsg-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.17.6+dfsg-2ubuntu1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.17.6+dfsg-2ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.17.6+dfsg-2ubuntu1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.17.6+dfsg-2",
        "5.17.6+dfsg-2ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.17.6+dfsg-2"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.17.6+dfsg-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.17.6+dfsg-2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.17.6+dfsg-2"
      ]
    }
  ],
  "aliases": [],
  "details": "Improper validation and restriction of a classpath path name vulnerability in  Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided \"key\" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.",
  "id": "UBUNTU-CVE-2026-33227",
  "modified": "2026-10-17T09:40:50Z",
  "published": "2026-04-07T09:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-33227"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33227"
    },
    {
      "type": "REPORT",
      "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-33227-announcement.txt"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2026/04/06/4"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-33227"
  ]
}

WID-SEC-W-2026-0991

Vulnerability from csaf_certbund - Published: 2026-04-07 22:00 - Updated: 2026-04-16 22:00

Summary

Apache ActiveMQ, Client, Broker und Web: Mehrere Schwachstellen

Severity

Hoch

Scope

2 vulnerabilities in this advisory, including CVE-2026-33227.

CVE-2026-33227

Known affected: 8 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-33227 (GCVE-0-2026-33227)

OESA-2026-2126 (CVE-2026-33227)

OESA-2026-2127 (CVE-2026-33227)

UBUNTU-CVE-2026-33227 (CVE-2026-33227)

WID-SEC-W-2026-0991

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour