The most popular and powerful open source messaging and Integration Patterns server.
Security Fix(es):
Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-49432)
Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM.
This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-49434)
Improper Authorization vulnerability in Apache ActiveMQ.
An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-49877)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.
An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker.
This issue affects Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-50734)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.
The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-52760)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-53916)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.
An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-53917)
activemq
The most popular and powerful open source messaging and Integration Patterns server.
Security Fix(es):
Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-49432)
Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM.
This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-49434)
Improper Authorization vulnerability in Apache ActiveMQ.
An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-49877)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.
An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker.
This issue affects Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-50734)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.
The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-52760)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-53916)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.
An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-53917)
activemq
The most popular and powerful open source messaging and Integration Patterns server.
Security Fix(es):
Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-49432)
Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM.
This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-49434)
Improper Authorization vulnerability in Apache ActiveMQ.
An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-49877)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.
An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker.
This issue affects Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-50734)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.
The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-52760)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-53916)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.
An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.(CVE-2026-53917)
activemq
antant-antlrant-apache-bcelant-apache-bsfant-apache-log4jant-apache-oroant-apache-regexpant-apache-resolverant-apache-xalan2ant-commons-loggingant-commons-netant-contribant-contrib-javadocant-javadocant-javamailant-jdependant-jmfant-jschant-junitant-libant-manualant-swingant-testutilant-xzantlrantlr-C++antlr-javadocantlr-manualantlr-toolaopallianceaopalliance-javadocapache-commons-beanutilsapache-commons-beanutils-javadocapache-commons-cliapache-commons-cli-javadocapache-commons-codecapache-commons-codec-javadocapache-commons-collectionsapache-commons-collections-javadocapache-commons-collections-testframeworkapache-commons-compressapache-commons-compress-javadocapache-commons-execapache-commons-exec-javadocapache-commons-ioapache-commons-io-javadocapache-commons-jxpathapache-commons-jxpath-javadocapache-commons-langapache-commons-lang-javadocapache-commons-lang3apache-commons-lang3-javadocapache-commons-loggingapache-commons-logging-javadocapache-commons-netapache-commons-net-javadocapache-commons-parentapache-ivyapache-ivy-javadocapache-parentapache-resource-bundlesaqute-bndaqute-bnd-javadocaqute-bndlibassertj-coreassertj-core-javadocatinjectatinject-javadocatinject-tckbcelbcel-javadocbeust-jcommanderbeust-jcommander-javadocbnd-maven-pluginbsfbsf-javadocbshbsh-javadocbsh-manualbyaccjbyaccj-debuginfobyaccj-debugsourcecal10ncal10n-javadoccdi-apicdi-api-javadoccglibcglib-javadoceasymockeasymock-javadocexec-maven-pluginexec-maven-plugin-javadocfelix-osgi-compendiumfelix-osgi-compendium-javadocfelix-osgi-corefelix-osgi-core-javadocfelix-osgi-foundationfelix-osgi-foundation-javadocfelix-parentfelix-utilsfelix-utils-javadocforge-parentfusesource-pomgeronimo-annotationgeronimo-annotation-javadocgeronimo-jmsgeronimo-jms-javadocgeronimo-jpageronimo-jpa-javadocgeronimo-parent-pomsglassfish-annotation-apiglassfish-annotation-api-javadocglassfish-elglassfish-el-apiglassfish-el-javadocglassfish-jsp-apiglassfish-jsp-api-javadocglassfish-legalglassfish-master-pomglassfish-servlet-apiglassfish-servlet-api-javadocgoogle-guicegoogle-guice-javadocguava20guava20-javadocguava20-testlibguice-assistedinjectguice-bomguice-extensionsguice-grapherguice-jmxguice-jndiguice-multibindingsguice-parentguice-servletguice-testlibguice-throwingprovidershamcresthamcrest-corehamcrest-demohamcrest-javadochawtjnihawtjni-javadochawtjni-runtimehttpcomponents-clienthttpcomponents-client-cachehttpcomponents-client-javadochttpcomponents-corehttpcomponents-core-javadochttpcomponents-projectisorelaxisorelax-javadocivy-localjakarta-commons-httpclientjakarta-commons-httpclient-demojakarta-commons-httpclient-javadocjakarta-commons-httpclient-manualjakarta-orojakarta-oro-javadocjansijansi-javadocjansi-nativejansi-native-javadocjava_cupjava_cup-javadocjava_cup-manualjavaccjavacc-demojavacc-javadocjavacc-manualjavacc-maven-pluginjavacc-maven-plugin-javadocjavamailjavamail-javadocjavapackages-filesystemjavapackages-localjavapackages-toolsjavassistjavassist-javadocjaxenjaxen-demojaxen-javadocjboss-interceptors-1.2-apijboss-interceptors-1.2-api-javadocjboss-parentjcl-over-slf4jjdependjdepend-demojdepend-javadocjdependencyjdependency-javadocjdomjdom-demojdom-javadocjdom2jdom2-javadocjflexjflex-javadocjlinejline-javadocjschjsch-javadocjsoupjsoup-javadocjsr-305jsr-305-javadocjtidyjtidy-javadocjul-to-slf4jjunitjunit-javadocjunit-manualjvnet-parentjzlibjzlib-demojzlib-javadoclog4j-over-slf4jlog4j12log4j12-javadocmavenmaven-antrun-pluginmaven-antrun-plugin-javadocmaven-archivermaven-archiver-javadocmaven-artifactmaven-artifact-managermaven-artifact-resolvermaven-artifact-resolver-javadocmaven-artifact-transfermaven-artifact-transfer-javadocmaven-assembly-pluginmaven-assembly-plugin-javadocmaven-cal10n-pluginmaven-clean-pluginmaven-clean-plugin-javadocmaven-common-artifact-filtersmaven-common-artifact-filters-javadocmaven-compiler-pluginmaven-compiler-plugin-javadocmaven-dependency-analyzermaven-dependency-analyzer-javadocmaven-dependency-pluginmaven-dependency-plugin-javadocmaven-dependency-treemaven-dependency-tree-javadocmaven-doxiamaven-doxia-coremaven-doxia-javadocmaven-doxia-logging-apimaven-doxia-module-aptmaven-doxia-module-confluencemaven-doxia-module-docbook-simplemaven-doxia-module-fmlmaven-doxia-module-latexmaven-doxia-module-rtfmaven-doxia-module-twikimaven-doxia-module-xdocmaven-doxia-module-xhtmlmaven-doxia-modulesmaven-doxia-sink-apimaven-doxia-sitetoolsmaven-doxia-sitetools-javadocmaven-doxia-test-docsmaven-doxia-testsmaven-enforcermaven-enforcer-apimaven-enforcer-javadocmaven-enforcer-pluginmaven-enforcer-rulesmaven-failsafe-pluginmaven-file-managementmaven-file-management-javadocmaven-filteringmaven-filtering-javadocmaven-hawtjni-pluginmaven-install-pluginmaven-install-plugin-javadocmaven-invokermaven-invoker-javadocmaven-invoker-pluginmaven-invoker-plugin-javadocmaven-jar-pluginmaven-jar-plugin-javadocmaven-javadocmaven-libmaven-localmaven-modelmaven-monitormaven-parentmaven-plugin-annotationsmaven-plugin-build-helpermaven-plugin-build-helper-javadocmaven-plugin-bundlemaven-plugin-bundle-javadocmaven-plugin-descriptormaven-plugin-pluginmaven-plugin-registrymaven-plugin-testingmaven-plugin-testing-harnessmaven-plugin-testing-javadocmaven-plugin-testing-toolsmaven-plugin-toolsmaven-plugin-tools-annotationsmaven-plugin-tools-antmaven-plugin-tools-apimaven-plugin-tools-beanshellmaven-plugin-tools-generatorsmaven-plugin-tools-javamaven-plugin-tools-javadocmaven-plugin-tools-javadocsmaven-plugin-tools-modelmaven-plugins-pommaven-profilemaven-projectmaven-remote-resources-pluginmaven-remote-resources-plugin-javadocmaven-reporting-apimaven-reporting-api-javadocmaven-reporting-implmaven-reporting-impl-javadocmaven-resolvermaven-resolver-apimaven-resolver-connector-basicmaven-resolver-implmaven-resolver-javadocmaven-resolver-spimaven-resolver-test-utilmaven-resolver-transport-classpathmaven-resolver-transport-filemaven-resolver-transport-httpmaven-resolver-transport-wagonmaven-resolver-utilmaven-resources-pluginmaven-resources-plugin-javadocmaven-scriptmaven-script-antmaven-script-beanshellmaven-script-interpretermaven-script-interpreter-javadocmaven-settingsmaven-shade-pluginmaven-shade-plugin-javadocmaven-sharedmaven-shared-incrementalmaven-shared-incremental-javadocmaven-shared-iomaven-shared-io-javadocmaven-shared-utilsmaven-shared-utils-javadocmaven-source-pluginmaven-source-plugin-javadocmaven-surefiremaven-surefire-javadocmaven-surefire-pluginmaven-surefire-provider-junitmaven-surefire-provider-testngmaven-surefire-report-parsermaven-surefire-report-pluginmaven-test-toolsmaven-toolchainmaven-verifiermaven-verifier-javadocmaven-wagonmaven-wagon-filemaven-wagon-ftpmaven-wagon-httpmaven-wagon-http-lightweightmaven-wagon-http-sharedmaven-wagon-javadocmaven-wagon-provider-apimaven-wagon-providersmaven2maven2-javadocmockitomockito-javadocmodellomodello-javadocmojo-parentmunge-maven-pluginmunge-maven-plugin-javadocobjectweb-asmobjectweb-asm-javadocobjectweb-pomobjenesisobjenesis-javadocos-maven-pluginos-maven-plugin-javadocosgi-annotationosgi-annotation-javadocosgi-compendiumosgi-compendium-javadocosgi-coreosgi-core-javadocplexus-ant-factoryplexus-ant-factory-javadocplexus-archiverplexus-archiver-javadocplexus-bsh-factoryplexus-bsh-factory-javadocplexus-build-apiplexus-build-api-javadocplexus-cipherplexus-cipher-javadocplexus-classworldsplexus-classworlds-javadocplexus-cliplexus-cli-javadocplexus-compilerplexus-compiler-extrasplexus-compiler-javadocplexus-compiler-pomplexus-component-apiplexus-component-api-javadocplexus-component-factories-pomplexus-components-pomplexus-containersplexus-containers-component-annotationsplexus-containers-component-javadocplexus-containers-component-metadataplexus-containers-container-defaultplexus-containers-javadocplexus-i18nplexus-i18n-javadocplexus-interactivityplexus-interactivity-apiplexus-interactivity-javadocplexus-interactivity-jlineplexus-interpolationplexus-interpolation-javadocplexus-ioplexus-io-javadocplexus-languagesplexus-languages-javadocplexus-pomplexus-resourcesplexus-resources-javadocplexus-sec-dispatcherplexus-sec-dispatcher-javadocplexus-utilsplexus-utils-javadocplexus-velocityplexus-velocity-javadocpowermockpowermock-api-easymockpowermock-api-mockitopowermock-api-supportpowermock-commonpowermock-corepowermock-javadocpowermock-junit4powermock-reflectpowermock-testngpython3-javapackagesqdoxqdox-javadocregexpregexp-javadocsisusisu-injectsisu-javadocsisu-mojossisu-mojos-javadocsisu-plexusslf4jslf4j-extslf4j-javadocslf4j-jclslf4j-jdk14slf4j-log4j12slf4j-manualslf4j-sourcessonatype-oss-parentsonatype-plugins-parentspec-version-maven-pluginspec-version-maven-plugin-javadocspice-parenttestngtestng-javadocvelocityvelocity-demovelocity-javadocvelocity-manualweld-parentxalan-j2xalan-j2-demoxalan-j2-javadocxalan-j2-manualxalan-j2-xsltcxbeanxbean-javadocxerces-j2xerces-j2-demoxerces-j2-javadocxml-commons-apisxml-commons-apis-javadocxml-commons-apis-manualxml-commons-resolverxml-commons-resolver-javadocxmlunitxmlunit-javadocxmvnxmvn-apixmvn-bisectxmvn-connector-aetherxmvn-connector-ivyxmvn-corexmvn-installxmvn-javadocxmvn-minimalxmvn-mojoxmvn-parent-pomxmvn-resolvexmvn-substxmvn-tools-pomxz-javaxz-java-javadoc
The javapackages-tools packages provide macros and scripts to support Java packaging.
Security Fix(es):
* org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
antant-antlrant-apache-bcelant-apache-bsfant-apache-log4jant-apache-oroant-apache-regexpant-apache-resolverant-apache-xalan2ant-commons-loggingant-commons-netant-contribant-contrib-javadocant-javadocant-javamailant-jdependant-jmfant-jschant-junitant-libant-manualant-swingant-testutilant-xzantlr-C++antlr-javadocantlr-manualantlr-toolaopallianceaopalliance-javadocapache-commons-beanutilsapache-commons-beanutils-javadocapache-commons-cliapache-commons-cli-javadocapache-commons-codecapache-commons-codec-javadocapache-commons-collectionsapache-commons-collections-javadocapache-commons-collections-testframeworkapache-commons-compressapache-commons-compress-javadocapache-commons-execapache-commons-exec-javadocapache-commons-ioapache-commons-io-javadocapache-commons-jxpathapache-commons-jxpath-javadocapache-commons-langapache-commons-lang-javadocapache-commons-lang3apache-commons-lang3-javadocapache-commons-loggingapache-commons-logging-javadocapache-commons-netapache-commons-net-javadocapache-commons-parentapache-ivyapache-ivy-javadocapache-parentapache-resource-bundlesaqute-bndaqute-bnd-javadocaqute-bndlibassertj-coreassertj-core-javadocatinjectatinject-javadocatinject-tckbcelbcel-javadocbeust-jcommanderbeust-jcommander-javadocbnd-maven-pluginbsfbsf-javadocbshbsh-javadocbsh-manualbyaccjcal10ncal10n-javadoccdi-apicdi-api-javadoccglibcglib-javadoceasymockeasymock-javadocexec-maven-pluginexec-maven-plugin-javadocfelix-osgi-compendiumfelix-osgi-compendium-javadocfelix-osgi-corefelix-osgi-core-javadocfelix-osgi-foundationfelix-osgi-foundation-javadocfelix-parentfelix-utilsfelix-utils-javadocforge-parentfusesource-pomgeronimo-annotationgeronimo-annotation-javadocgeronimo-jmsgeronimo-jms-javadocgeronimo-jpageronimo-jpa-javadocgeronimo-parent-pomsglassfish-annotation-apiglassfish-annotation-api-javadocglassfish-elglassfish-el-apiglassfish-el-javadocglassfish-jsp-apiglassfish-jsp-api-javadocglassfish-legalglassfish-master-pomglassfish-servlet-apiglassfish-servlet-api-javadocgoogle-guicegoogle-guice-javadocguava20guava20-javadocguava20-testlibguice-assistedinjectguice-bomguice-extensionsguice-grapherguice-jmxguice-jndiguice-multibindingsguice-parentguice-servletguice-testlibguice-throwingprovidershamcresthamcrest-corehamcrest-demohamcrest-javadochawtjnihawtjni-javadochawtjni-runtimehttpcomponents-clienthttpcomponents-client-cachehttpcomponents-client-javadochttpcomponents-corehttpcomponents-core-javadochttpcomponents-projectisorelaxisorelax-javadocivy-localjakarta-commons-httpclientjakarta-commons-httpclient-demojakarta-commons-httpclient-javadocjakarta-commons-httpclient-manualjakarta-orojakarta-oro-javadocjansijansi-javadocjansi-nativejansi-native-javadocjava_cupjava_cup-javadocjava_cup-manualjavaccjavacc-demojavacc-javadocjavacc-manualjavacc-maven-pluginjavacc-maven-plugin-javadocjavamailjavamail-javadocjavapackages-filesystemjavapackages-localjavapackages-toolsjavassistjavassist-javadocjaxenjaxen-demojaxen-javadocjboss-interceptors-1.2-apijboss-interceptors-1.2-api-javadocjboss-parentjcl-over-slf4jjdependjdepend-demojdepend-javadocjdependencyjdependency-javadocjdomjdom-demojdom-javadocjdom2jdom2-javadocjflexjflex-javadocjlinejline-javadocjschjsch-javadocjsoupjsoup-javadocjsr-305jsr-305-javadocjtidyjtidy-javadocjul-to-slf4jjunitjunit-javadocjunit-manualjvnet-parentjzlibjzlib-demojzlib-javadoclog4j-over-slf4jlog4j12log4j12-javadocmavenmaven-antrun-pluginmaven-antrun-plugin-javadocmaven-archivermaven-archiver-javadocmaven-artifactmaven-artifact-managermaven-artifact-resolvermaven-artifact-resolver-javadocmaven-artifact-transfermaven-artifact-transfer-javadocmaven-assembly-pluginmaven-assembly-plugin-javadocmaven-cal10n-pluginmaven-clean-pluginmaven-clean-plugin-javadocmaven-common-artifact-filtersmaven-common-artifact-filters-javadocmaven-compiler-pluginmaven-compiler-plugin-javadocmaven-dependency-analyzermaven-dependency-analyzer-javadocmaven-dependency-pluginmaven-dependency-plugin-javadocmaven-dependency-treemaven-dependency-tree-javadocmaven-doxiamaven-doxia-coremaven-doxia-javadocmaven-doxia-logging-apimaven-doxia-module-aptmaven-doxia-module-confluencemaven-doxia-module-docbook-simplemaven-doxia-module-fmlmaven-doxia-module-latexmaven-doxia-module-rtfmaven-doxia-module-twikimaven-doxia-module-xdocmaven-doxia-module-xhtmlmaven-doxia-modulesmaven-doxia-sink-apimaven-doxia-sitetoolsmaven-doxia-sitetools-javadocmaven-doxia-test-docsmaven-doxia-testsmaven-enforcermaven-enforcer-apimaven-enforcer-javadocmaven-enforcer-pluginmaven-enforcer-rulesmaven-failsafe-pluginmaven-file-managementmaven-file-management-javadocmaven-filteringmaven-filtering-javadocmaven-hawtjni-pluginmaven-install-pluginmaven-install-plugin-javadocmaven-invokermaven-invoker-javadocmaven-invoker-pluginmaven-invoker-plugin-javadocmaven-jar-pluginmaven-jar-plugin-javadocmaven-javadocmaven-libmaven-localmaven-modelmaven-monitormaven-parentmaven-plugin-annotationsmaven-plugin-build-helpermaven-plugin-build-helper-javadocmaven-plugin-bundlemaven-plugin-bundle-javadocmaven-plugin-descriptormaven-plugin-pluginmaven-plugin-registrymaven-plugin-testingmaven-plugin-testing-harnessmaven-plugin-testing-javadocmaven-plugin-testing-toolsmaven-plugin-toolsmaven-plugin-tools-annotationsmaven-plugin-tools-antmaven-plugin-tools-apimaven-plugin-tools-beanshellmaven-plugin-tools-generatorsmaven-plugin-tools-javamaven-plugin-tools-javadocmaven-plugin-tools-javadocsmaven-plugin-tools-modelmaven-plugins-pommaven-profilemaven-projectmaven-remote-resources-pluginmaven-remote-resources-plugin-javadocmaven-reporting-apimaven-reporting-api-javadocmaven-reporting-implmaven-reporting-impl-javadocmaven-resolvermaven-resolver-apimaven-resolver-connector-basicmaven-resolver-implmaven-resolver-javadocmaven-resolver-spimaven-resolver-test-utilmaven-resolver-transport-classpathmaven-resolver-transport-filemaven-resolver-transport-httpmaven-resolver-transport-wagonmaven-resolver-utilmaven-resources-pluginmaven-resources-plugin-javadocmaven-scriptmaven-script-antmaven-script-beanshellmaven-script-interpretermaven-script-interpreter-javadocmaven-settingsmaven-shade-pluginmaven-shade-plugin-javadocmaven-sharedmaven-shared-incrementalmaven-shared-incremental-javadocmaven-shared-iomaven-shared-io-javadocmaven-shared-utilsmaven-shared-utils-javadocmaven-source-pluginmaven-source-plugin-javadocmaven-surefiremaven-surefire-javadocmaven-surefire-pluginmaven-surefire-provider-junitmaven-surefire-provider-testngmaven-surefire-report-parsermaven-surefire-report-pluginmaven-test-toolsmaven-toolchainmaven-verifiermaven-verifier-javadocmaven-wagonmaven-wagon-filemaven-wagon-ftpmaven-wagon-httpmaven-wagon-http-lightweightmaven-wagon-http-sharedmaven-wagon-javadocmaven-wagon-provider-apimaven-wagon-providersmaven2-javadocmockitomockito-javadocmodellomodello-javadocmojo-parentmunge-maven-pluginmunge-maven-plugin-javadocobjectweb-asmobjectweb-asm-javadocobjectweb-pomobjenesisobjenesis-javadocos-maven-pluginos-maven-plugin-javadocosgi-annotationosgi-annotation-javadocosgi-compendiumosgi-compendium-javadocosgi-coreosgi-core-javadocplexus-ant-factoryplexus-ant-factory-javadocplexus-archiverplexus-archiver-javadocplexus-bsh-factoryplexus-bsh-factory-javadocplexus-build-apiplexus-build-api-javadocplexus-cipherplexus-cipher-javadocplexus-classworldsplexus-classworlds-javadocplexus-cliplexus-cli-javadocplexus-compilerplexus-compiler-extrasplexus-compiler-javadocplexus-compiler-pomplexus-component-apiplexus-component-api-javadocplexus-component-factories-pomplexus-components-pomplexus-containersplexus-containers-component-annotationsplexus-containers-component-javadocplexus-containers-component-metadataplexus-containers-container-defaultplexus-containers-javadocplexus-i18nplexus-i18n-javadocplexus-interactivityplexus-interactivity-apiplexus-interactivity-javadocplexus-interactivity-jlineplexus-interpolationplexus-interpolation-javadocplexus-ioplexus-io-javadocplexus-languagesplexus-languages-javadocplexus-pomplexus-resourcesplexus-resources-javadocplexus-sec-dispatcherplexus-sec-dispatcher-javadocplexus-utilsplexus-utils-javadocplexus-velocityplexus-velocity-javadocpowermock-api-easymockpowermock-api-mockitopowermock-api-supportpowermock-commonpowermock-corepowermock-javadocpowermock-junit4powermock-reflectpowermock-testngpython3-javapackagesqdoxqdox-javadocregexpregexp-javadocsisu-injectsisu-javadocsisu-mojossisu-mojos-javadocsisu-plexusslf4jslf4j-extslf4j-javadocslf4j-jclslf4j-jdk14slf4j-log4j12slf4j-manualslf4j-sourcessonatype-oss-parentsonatype-plugins-parentspec-version-maven-pluginspec-version-maven-plugin-javadocspice-parenttestngtestng-javadocvelocityvelocity-demovelocity-javadocvelocity-manualweld-parentxalan-j2xalan-j2-demoxalan-j2-javadocxalan-j2-manualxalan-j2-xsltcxbeanxbean-javadocxerces-j2xerces-j2-demoxerces-j2-javadocxml-commons-apisxml-commons-apis-javadocxml-commons-apis-manualxml-commons-resolverxml-commons-resolver-javadocxmlunitxmlunit-javadocxmvnxmvn-apixmvn-bisectxmvn-connector-aetherxmvn-connector-ivyxmvn-corexmvn-installxmvn-javadocxmvn-minimalxmvn-mojoxmvn-parent-pomxmvn-resolvexmvn-substxmvn-tools-pomxz-javaxz-java-javadoc
antant-antlrant-apache-bcelant-apache-bsfant-apache-log4jant-apache-oroant-apache-regexpant-apache-resolverant-apache-xalan2ant-commons-loggingant-commons-netant-contribant-contrib-javadocant-javadocant-javamailant-jdependant-jmfant-jschant-junitant-libant-manualant-swingant-testutilant-xzantlrantlr-C++antlr-javadocantlr-manualantlr-toolaopallianceaopalliance-javadocapache-commons-beanutilsapache-commons-beanutils-javadocapache-commons-cliapache-commons-cli-javadocapache-commons-codecapache-commons-codec-javadocapache-commons-collectionsapache-commons-collections-javadocapache-commons-collections-testframeworkapache-commons-compressapache-commons-compress-javadocapache-commons-execapache-commons-exec-javadocapache-commons-ioapache-commons-io-javadocapache-commons-jxpathapache-commons-jxpath-javadocapache-commons-langapache-commons-lang-javadocapache-commons-lang3apache-commons-lang3-javadocapache-commons-loggingapache-commons-logging-javadocapache-commons-netapache-commons-net-javadocapache-commons-parentapache-ivyapache-ivy-javadocapache-parentapache-resource-bundlesaqute-bndaqute-bnd-javadocaqute-bndlibassertj-coreassertj-core-javadocatinjectatinject-javadocatinject-tckbcelbcel-javadocbeust-jcommanderbeust-jcommander-javadocbnd-maven-pluginbsfbsf-javadocbshbsh-javadocbsh-manualbyaccjbyaccj-debuginfobyaccj-debugsourcecal10ncal10n-javadoccdi-apicdi-api-javadoccglibcglib-javadoceasymockeasymock-javadocexec-maven-pluginexec-maven-plugin-javadocfelix-osgi-compendiumfelix-osgi-compendium-javadocfelix-osgi-corefelix-osgi-core-javadocfelix-osgi-foundationfelix-osgi-foundation-javadocfelix-parentfelix-utilsfelix-utils-javadocforge-parentfusesource-pomgeronimo-annotationgeronimo-annotation-javadocgeronimo-jmsgeronimo-jms-javadocgeronimo-jpageronimo-jpa-javadocgeronimo-parent-pomsglassfish-annotation-apiglassfish-annotation-api-javadocglassfish-elglassfish-el-apiglassfish-el-javadocglassfish-jsp-apiglassfish-jsp-api-javadocglassfish-legalglassfish-master-pomglassfish-servlet-apiglassfish-servlet-api-javadocgoogle-guicegoogle-guice-javadocguava20guava20-javadocguava20-testlibguice-assistedinjectguice-bomguice-extensionsguice-grapherguice-jmxguice-jndiguice-multibindingsguice-parentguice-servletguice-testlibguice-throwingprovidershamcresthamcrest-corehamcrest-demohamcrest-javadochawtjnihawtjni-javadochawtjni-runtimehttpcomponents-clienthttpcomponents-client-cachehttpcomponents-client-javadochttpcomponents-corehttpcomponents-core-javadochttpcomponents-projectisorelaxisorelax-javadocivy-localjakarta-commons-httpclientjakarta-commons-httpclient-demojakarta-commons-httpclient-javadocjakarta-commons-httpclient-manualjakarta-orojakarta-oro-javadocjansijansi-javadocjansi-nativejansi-native-javadocjava_cupjava_cup-javadocjava_cup-manualjavaccjavacc-demojavacc-javadocjavacc-manualjavacc-maven-pluginjavacc-maven-plugin-javadocjavamailjavamail-javadocjavapackages-filesystemjavapackages-localjavapackages-toolsjavassistjavassist-javadocjaxenjaxen-demojaxen-javadocjboss-interceptors-1.2-apijboss-interceptors-1.2-api-javadocjboss-parentjcl-over-slf4jjdependjdepend-demojdepend-javadocjdependencyjdependency-javadocjdomjdom-demojdom-javadocjdom2jdom2-javadocjflexjflex-javadocjlinejline-javadocjschjsch-javadocjsoupjsoup-javadocjsr-305jsr-305-javadocjtidyjtidy-javadocjul-to-slf4jjunitjunit-javadocjunit-manualjvnet-parentjzlibjzlib-demojzlib-javadoclog4j-over-slf4jlog4j12log4j12-javadocmavenmaven-antrun-pluginmaven-antrun-plugin-javadocmaven-archivermaven-archiver-javadocmaven-artifactmaven-artifact-managermaven-artifact-resolvermaven-artifact-resolver-javadocmaven-artifact-transfermaven-artifact-transfer-javadocmaven-assembly-pluginmaven-assembly-plugin-javadocmaven-cal10n-pluginmaven-clean-pluginmaven-clean-plugin-javadocmaven-common-artifact-filtersmaven-common-artifact-filters-javadocmaven-compiler-pluginmaven-compiler-plugin-javadocmaven-dependency-analyzermaven-dependency-analyzer-javadocmaven-dependency-pluginmaven-dependency-plugin-javadocmaven-dependency-treemaven-dependency-tree-javadocmaven-doxiamaven-doxia-coremaven-doxia-javadocmaven-doxia-logging-apimaven-doxia-module-aptmaven-doxia-module-confluencemaven-doxia-module-docbook-simplemaven-doxia-module-fmlmaven-doxia-module-latexmaven-doxia-module-rtfmaven-doxia-module-twikimaven-doxia-module-xdocmaven-doxia-module-xhtmlmaven-doxia-modulesmaven-doxia-sink-apimaven-doxia-sitetoolsmaven-doxia-sitetools-javadocmaven-doxia-test-docsmaven-doxia-testsmaven-enforcermaven-enforcer-apimaven-enforcer-javadocmaven-enforcer-pluginmaven-enforcer-rulesmaven-failsafe-pluginmaven-file-managementmaven-file-management-javadocmaven-filteringmaven-filtering-javadocmaven-hawtjni-pluginmaven-install-pluginmaven-install-plugin-javadocmaven-invokermaven-invoker-javadocmaven-invoker-pluginmaven-invoker-plugin-javadocmaven-jar-pluginmaven-jar-plugin-javadocmaven-javadocmaven-libmaven-localmaven-modelmaven-monitormaven-parentmaven-plugin-annotationsmaven-plugin-build-helpermaven-plugin-build-helper-javadocmaven-plugin-bundlemaven-plugin-bundle-javadocmaven-plugin-descriptormaven-plugin-pluginmaven-plugin-registrymaven-plugin-testingmaven-plugin-testing-harnessmaven-plugin-testing-javadocmaven-plugin-testing-toolsmaven-plugin-toolsmaven-plugin-tools-annotationsmaven-plugin-tools-antmaven-plugin-tools-apimaven-plugin-tools-beanshellmaven-plugin-tools-generatorsmaven-plugin-tools-javamaven-plugin-tools-javadocmaven-plugin-tools-javadocsmaven-plugin-tools-modelmaven-plugins-pommaven-profilemaven-projectmaven-remote-resources-pluginmaven-remote-resources-plugin-javadocmaven-reporting-apimaven-reporting-api-javadocmaven-reporting-implmaven-reporting-impl-javadocmaven-resolvermaven-resolver-apimaven-resolver-connector-basicmaven-resolver-implmaven-resolver-javadocmaven-resolver-spimaven-resolver-test-utilmaven-resolver-transport-classpathmaven-resolver-transport-filemaven-resolver-transport-httpmaven-resolver-transport-wagonmaven-resolver-utilmaven-resources-pluginmaven-resources-plugin-javadocmaven-scriptmaven-script-antmaven-script-beanshellmaven-script-interpretermaven-script-interpreter-javadocmaven-settingsmaven-shade-pluginmaven-shade-plugin-javadocmaven-sharedmaven-shared-incrementalmaven-shared-incremental-javadocmaven-shared-iomaven-shared-io-javadocmaven-shared-utilsmaven-shared-utils-javadocmaven-source-pluginmaven-source-plugin-javadocmaven-surefiremaven-surefire-javadocmaven-surefire-pluginmaven-surefire-provider-junitmaven-surefire-provider-testngmaven-surefire-report-parsermaven-surefire-report-pluginmaven-test-toolsmaven-toolchainmaven-verifiermaven-verifier-javadocmaven-wagonmaven-wagon-filemaven-wagon-ftpmaven-wagon-httpmaven-wagon-http-lightweightmaven-wagon-http-sharedmaven-wagon-javadocmaven-wagon-provider-apimaven-wagon-providersmaven2maven2-javadocmockitomockito-javadocmodellomodello-javadocmojo-parentmunge-maven-pluginmunge-maven-plugin-javadocobjectweb-asmobjectweb-asm-javadocobjectweb-pomobjenesisobjenesis-javadocos-maven-pluginos-maven-plugin-javadocosgi-annotationosgi-annotation-javadocosgi-compendiumosgi-compendium-javadocosgi-coreosgi-core-javadocplexus-ant-factoryplexus-ant-factory-javadocplexus-archiverplexus-archiver-javadocplexus-bsh-factoryplexus-bsh-factory-javadocplexus-build-apiplexus-build-api-javadocplexus-cipherplexus-cipher-javadocplexus-classworldsplexus-classworlds-javadocplexus-cliplexus-cli-javadocplexus-compilerplexus-compiler-extrasplexus-compiler-javadocplexus-compiler-pomplexus-component-apiplexus-component-api-javadocplexus-component-factories-pomplexus-components-pomplexus-containersplexus-containers-component-annotationsplexus-containers-component-javadocplexus-containers-component-metadataplexus-containers-container-defaultplexus-containers-javadocplexus-i18nplexus-i18n-javadocplexus-interactivityplexus-interactivity-apiplexus-interactivity-javadocplexus-interactivity-jlineplexus-interpolationplexus-interpolation-javadocplexus-ioplexus-io-javadocplexus-languagesplexus-languages-javadocplexus-pomplexus-resourcesplexus-resources-javadocplexus-sec-dispatcherplexus-sec-dispatcher-javadocplexus-utilsplexus-utils-javadocplexus-velocityplexus-velocity-javadocpowermockpowermock-api-easymockpowermock-api-mockitopowermock-api-supportpowermock-commonpowermock-corepowermock-javadocpowermock-junit4powermock-reflectpowermock-testngpython3-javapackagesqdoxqdox-javadocregexpregexp-javadocsisusisu-injectsisu-javadocsisu-mojossisu-mojos-javadocsisu-plexusslf4jslf4j-extslf4j-javadocslf4j-jclslf4j-jdk14slf4j-log4j12slf4j-manualslf4j-sourcessonatype-oss-parentsonatype-plugins-parentspec-version-maven-pluginspec-version-maven-plugin-javadocspice-parenttestngtestng-javadocvelocityvelocity-demovelocity-javadocvelocity-manualweld-parentxalan-j2xalan-j2-demoxalan-j2-javadocxalan-j2-manualxalan-j2-xsltcxbeanxbean-javadocxerces-j2xerces-j2-demoxerces-j2-javadocxml-commons-apisxml-commons-apis-javadocxml-commons-apis-manualxml-commons-resolverxml-commons-resolver-javadocxmlunitxmlunit-javadocxmvnxmvn-apixmvn-bisectxmvn-connector-aetherxmvn-connector-ivyxmvn-corexmvn-installxmvn-javadocxmvn-minimalxmvn-mojoxmvn-parent-pomxmvn-resolvexmvn-substxmvn-tools-pomxz-javaxz-java-javadoc
The most popular and powerful open source messaging and Integration Patterns server.
Security Fix(es):
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.
The MessageServlet in the ActiveMQ web console API copies every JMS message
property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.(CVE-2026-42253)
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.(CVE-2026-42588)
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Non-parenthesized discovery wrappers such as `masterslave:vm://...,...`
and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.
Original description from CVE-2026-34197.
Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.(CVE-2026-45505)
Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.
This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.(CVE-2026-46605)
Incorrect Default Permissions vulnerability in Apache ActiveMQ.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.
Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.(CVE-2026-49157)
Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated.
This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.(CVE-2026-49270)
activemq
The most popular and powerful open source messaging and Integration Patterns server.
Security Fix(es):
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.
The MessageServlet in the ActiveMQ web console API copies every JMS message
property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.(CVE-2026-42253)
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.(CVE-2026-42588)
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Non-parenthesized discovery wrappers such as `masterslave:vm://...,...`
and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.
Original description from CVE-2026-34197.
Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.(CVE-2026-45505)
Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.
This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.(CVE-2026-46605)
Incorrect Default Permissions vulnerability in Apache ActiveMQ.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.
Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.(CVE-2026-49157)
Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated.
This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.(CVE-2026-49270)
activemq