{"id":"OESA-2026-4777","summary":"activemq security update","details":"The most popular and powerful open source messaging and Integration Patterns server.\r\n\r\nSecurity Fix(es):\n\nInput validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.(CVE-2026-108500)\n\nImproper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.\n\n\n\nThe ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client to spoof another user's ids. This allows:\n\n\n\n\n\n  *   an authenticated client consumes from another connection's temporary queue/topic by putting the victim's connection id in its own ConsumerId, bypassing the broker-side ownership check. \n  *  a duplicate ConsumerId registration is only logged, after which the attacker's RemoveInfo or disconnect tears down the victim's live subscription\n  *  a forged MessageAck for the victim's ConsumerId permanently deletes an in-flight, unacknowledged message.\n\n\n\n\n\n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.(CVE-2026-108946)\n\nDenial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker.\n\n\n\nAn authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.(CVE-2026-108949)\n\nImproper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.\n\n\n\nA user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. \n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.(CVE-2026-111821)\n\nImproper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.\n\n\n\nAfter the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.(CVE-2026-111822)","modified":"2026-11-11T12:45:04.182322074Z","published":"2026-11-11T12:26:04Z","upstream":["CVE-2026-108500","CVE-2026-108946","CVE-2026-108949","CVE-2026-111821","CVE-2026-111822"],"database_specific":{"severity":"High"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4777"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108500"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108946"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108949"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111821"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111822"}],"affected":[{"package":{"name":"activemq","ecosystem":"openEuler:24.03-LTS-SP1","purl":"pkg:rpm/openEuler/activemq&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.12-1.oe2403sp1"}]}],"ecosystem_specific":{"noarch":["activemq-5.19.12-1.oe2403sp1.noarch.rpm","activemq-javadoc-5.19.12-1.oe2403sp1.noarch.rpm"],"src":["activemq-5.19.12-1.oe2403sp1.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-4777.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}