Apache ActiveMQ Artemis DoS
Priority LOW 38CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 12 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
Why it matters now
EPSS 0.0274 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Apache ActiveMQ Artemis (Apache Software Foundation): 2.20.0org.apache.activemq:artemis-core-client (Maven): 2.19.1Red Hat: 12 advisoriesRed Hat: 12 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ActiveMQ Artemis | 2.19.0 to before 2.20.0 | 2.20.0 | Patch available | CNA |
| — | org.apache.activemq:artemis-core-client (Maven) | before 2.19.1 | 2.19.1 | Patch available | GHSA-pr38-qpxm-g88x |
- Apache ActiveMQ Artemis VendorApache Affected 2.19.0 to before 2.20.0 Fixed in 2.20.0 Patch available CNA
- org.apache.activemq:artemis-core-client (Maven) Vendor— Affected before 2.19.1 Fixed in 2.19.1 Patch available GHSA-pr38-qpxm-g88x
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* | before 2.19.1 | Vulnerable | Apache |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* Versions before 2.19.1 Vulnerable ·Apache
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA Apache ActiveMQ Artemis (Apache Software Foundation) Fixed in 2.20.0
- Fix · GHSA-pr38-qpxm-g88x org.apache.activemq:artemis-core-client (Maven) Fixed in 2.19.1 Advisory →
Red Hat 12 advisories
- RHSA-2025:4437 Released 2025-05-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.13 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-activemq-artemis-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-cli-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-commons-2.9.0-10.redhat_00021.1.el7eap +44
- RHSA-2025:4226 Released 2025-04-28 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
- RHSA-2022:7417 Released 2022-11-03 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.1 security update
- Red Hat Single Sign-On 7.6.1
Show 9 more Red Hat advisories
- RHSA-2022:7411 Released 2022-11-03 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.1 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-1-5.el9sso, rh-sso7-javapackages-filesystem-6.0.0-7.el9sso, rh-sso7-javapackages-tools-6.0.0-7.el9sso +4
- RHSA-2022:7410 Released 2022-11-03 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.1 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.3-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00001.1.el8sso
- RHSA-2022:7409 Released 2022-11-03 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.1 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.3-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00001.1.el7sso
- RHSA-2022:6813 Released 2022-10-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.1 security update
- RHPAM 7.13.1 async
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
- RHSA-2022:5101 Released 2022-06-16 · Red Hat rating ImportantRed Hat AMQ Broker 7.10.0 release and security update
- Red Hat AMQ 7.10.0
- RHSA-2022:4919 Released 2022-06-06 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el8eap, eap7-activemq-artemis-cli-2.16.0-9.redhat_00042.1.el8eap, eap7-activemq-artemis-commons-2.16.0-9.redhat_00042.1.el8eap +47
- RHSA-2022:4918 Released 2022-06-06 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el7eap, eap7-activemq-artemis-cli-2.16.0-9.redhat_00042.1.el7eap, eap7-activemq-artemis-commons-2.16.0-9.redhat_00042.1.el7eap +47
- RHSA-2022:4922 Released 2022-06-06 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.5 security update
- Red Hat JBoss Enterprise Application Platform com.fasterxml.jackson.core.jackson-databind-2.12.6.1-redhat-00003.jar, com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-4.1.72.Final-redhat-00001.jar +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| RHPAM 7.13.1 async | Fixed | RHSA-2022:6813 |
| Red Hat AMQ 7.10.0 | Fixed | RHSA-2022:5101 |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2022:4918 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2022:4919 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2022:4922 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:4226 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:4437 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2022:7409 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2022:7410 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2022:7411 |
| Red Hat Single Sign-On 7.6.1 | Fixed | RHSA-2022:7417 |
Not affected: 3 products
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss Enterprise Application Platform
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23913
- 2026-10-03 Alias added: GHSA-pr38-qpxm-g88x
References
Advisory 2
Other 8
- https://github.com/github/codeql-java-CVE-coverage/issues/1061
- https://github.com/apache/activemq-artemis/pull/3862
- https://github.com/apache/activemq-artemis/pull/3862/commits/1f92368240229b8f5db92a92a72c703faf83e9b7
- https://github.com/apache/activemq-artemis/pull/3871
- https://github.com/apache/activemq-artemis/pull/3871/commits/153d2e9a979aead8dff95fbc91d659ecc7d0fb82
- https://github.com/apache/activemq-artemis
- https://issues.apache.org/jira/browse/ARTEMIS-3593
- https://security.netapp.com/advisory/ntap-20220303-0003
More Apache Artemis vulnerabilities
- TI-2026-21857 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation CVSS 4.0CRITICAL 9.3
- TI-2023-27710 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans CVSS 3.1HIGH 8.8
- TI-2026-41732 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment CVSS 3.1CRITICAL 9.8
- TI-2026-36537 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
- TI-2026-47754 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
- TI-2021-08067 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind CVSS 3.1HIGH 7.5
Sources
- CVE-2022-23913 · CVE Program
- CVE-2022-23913 · NVD
- FIRST EPSS
- GHSA-pr38-qpxm-g88x · GitHub Advisory Database · CC BY 4.0
- CVE-2022-23913 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences