Source Package: activemq (5.17.2+dfsg-2+deb12u1)
Java message broker core libraries
The following binary packages are built from this source package:
- libactivemq-java
Java message broker core libraries
Packages / Debian 12 (Bookworm) / Source / java / activemq
Known vulnerabilities
Matching against OpenFactory catalog package versions is in progress.
| CVE | Severity | Version impact |
|---|---|---|
| [CVE-2026-59878] Published: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of | Medium | AffectedDetails (2)
|
| [CVE-2026-61487] Published: Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an Acti | Medium | AffectedDetails (2)
|
| [CVE-2026-52760] Published: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a messag | Medium(6.1) | AffectedDetails (2)
|
| [CVE-2026-49432] Published: Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-s | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-49434] Published: Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entries in LDAP that match the configured sea | High(7.6) | AffectedDetails (2)
|
| [CVE-2026-49877] Published: Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectl | High(8.1) | AffectedDetails (2)
|
| [CVE-2026-50734] Published: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a craf | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-50750] Published: Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause brok | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-53916] Published: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-53917] Published: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by send | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-54475] Published: Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that | High(8.2) | AffectedDetails (2)
|
| [CVE-2026-42253] Published: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies e | Medium(6.1) | AffectedDetails (2)
|
| [CVE-2026-42588] Published: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the | High(8.1) | AffectedDetails (2)
|
| [CVE-2026-45505] Published: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappe | High(8.8) | AffectedDetails (2)
|
| [CVE-2026-46605] Published: Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apac | Medium(6.5) | AffectedDetails (2)
|
| [CVE-2026-49157] Published: Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-adm | High(8.8) | AffectedDetails (2)
|
| [CVE-2026-49270] Published: Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers that are configured with a network connector with syncDurable | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-40466] Published: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may byp | High(8.8) | AffectedDetails (2)
|
| [CVE-2026-41043] Published: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing | Medium(6.5) | AffectedDetails (2)
|
| [CVE-2026-41044] Published: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use t | High(8.8) | AffectedDetails (2)
|
Last synced:
Sources
- Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Observed SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Result
- match verified
- Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Observed SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Result
- match verified
- Debian 12 (Bookworm) security main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-security-main-amd64:f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
Repository-signature verification record- Signed-object SHA-256
- 6d12b591dde8841119e7e66de94b2af438681faebffabe08ea364290f7aaee1c
- Signer fingerprint
- ED541312A33F1128F10B1C6C54404762BBB6E853
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
- Observed SHA-256
- f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
- Result
- match verified
- Debian 12 (Bookworm) security main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-security-main-arm64:f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
Repository-signature verification record- Signed-object SHA-256
- 6d12b591dde8841119e7e66de94b2af438681faebffabe08ea364290f7aaee1c
- Signer fingerprint
- ED541312A33F1128F10B1C6C54404762BBB6E853
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
- Observed SHA-256
- f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
- Result
- match verified