Apache ActiveMQ vulnerabilities

Latest Apache ActiveMQ CVEs

Newest publication first

1. CVE-2026-108500 Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection

   Published 2026-11-04

   Medium·CVSS 5.4

   Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate...

2. CVE-2026-50734 Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation

   Published 2026-06-30

   High·CVSS 7.5

   Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not vali...

3. CVE-2025-27533 Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

   Published 2025-05-07

   Medium·CVSS 6.9 EPSS 9.1%

   Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depl...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.