Vulnerabilities

TI-2026-85020 CVE-2026-108500 · GHSA-xg6g-hg3m-3p78

LDAP DN injection in Apache ActiveMQ authorization map

LOW 22

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special charac…

CVSS — EPSS 0.00216 Published 2026-11-04 Partial fix · 6.3.3, 5.19.12 +1 CWE-20

TI-2026-85008 CVE-2026-108946 · GHSA-r4jx-783j-33mp

Apache ActiveMQ broker accepts spoofed connection ids from clients

LOW 22

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.

CVSS — EPSS 0.00229 Published 2026-11-04 Partial fix · 6.3.3, 5.19.12 CWE-20

TI-2026-85012 CVE-2026-111822 · GHSA-5jrv-f37p-8c36

Apache ActiveMQ keeps write access after live ACL revocation

LOW 22

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.

CVSS — EPSS 0.00216 Published 2026-11-04 Partial fix · 6.3.3, 5.19.12

TI-2026-85011 CVE-2026-111821 · GHSA-c86r-9hm3-5pcc

Oversized durable subscription IDs crash Apache ActiveMQ KahaDB brokers

LOW 22

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.

CVSS — EPSS 0.00216 Published 2026-11-04 Partial fix · 6.3.3, 5.19.12 CWE-20

TI-2026-85009 CVE-2026-108949 · GHSA-5j2c-q47c-c6w5

Repeated rejected consumer requests exhaust memory in Apache ActiveMQ

LOW 29

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00468 Published 2026-11-04 Partial fix · 6.3.3, 5.19.12 CWE-401

Vulnerabilities

Filters

LDAP DN injection in Apache ActiveMQ authorization map

Apache ActiveMQ broker accepts spoofed connection ids from clients

Apache ActiveMQ keeps write access after live ACL revocation

Oversized durable subscription IDs crash Apache ActiveMQ KahaDB brokers

Repeated rejected consumer requests exhaust memory in Apache ActiveMQ