Activemq All
Monthly
Improper input validation in the TopicRegion component of Apache ActiveMQ allows an authenticated broker client to forge the clientId field in a durable subscription removal request, causing the broker to delete a subscription belonging to a different, legitimate client. All ActiveMQ deployments in the 5.x line before 5.19.11 and the 6.x line before 6.3.2 are affected across all platforms. With EPSS at 0.20% and no active exploitation observed, real-world urgency is moderate, though the silent integrity impact on guaranteed-delivery messaging architectures makes prompt patching advisable.
Denial of service in Apache ActiveMQ's AMQP NIO connector allows remote unauthenticated attackers to exhaust the NIO thread pool by sending a crafted negative frame size value, causing legitimate connection disruption. Affects ActiveMQ versions before 5.19.9 and 6.x before 6.2.8. No known active exploitation, but rated moderate by the vendor due to network exposure.
Authorization bypass in Apache ActiveMQ 5.x before 5.19.9 and 6.x before 6.2.8 allows authenticated low-privilege users to publish messages to any queue without proper write ACLs by abusing temporary composite destinations. This enables unauthorized message injection into restricted queues, potentially disrupting message integrity and business logic. No active exploitation or public exploit code has been identified.
Improper input validation in the TopicRegion component of Apache ActiveMQ allows an authenticated broker client to forge the clientId field in a durable subscription removal request, causing the broker to delete a subscription belonging to a different, legitimate client. All ActiveMQ deployments in the 5.x line before 5.19.11 and the 6.x line before 6.3.2 are affected across all platforms. With EPSS at 0.20% and no active exploitation observed, real-world urgency is moderate, though the silent integrity impact on guaranteed-delivery messaging architectures makes prompt patching advisable.
Denial of service in Apache ActiveMQ's AMQP NIO connector allows remote unauthenticated attackers to exhaust the NIO thread pool by sending a crafted negative frame size value, causing legitimate connection disruption. Affects ActiveMQ versions before 5.19.9 and 6.x before 6.2.8. No known active exploitation, but rated moderate by the vendor due to network exposure.
Authorization bypass in Apache ActiveMQ 5.x before 5.19.9 and 6.x before 6.2.8 allows authenticated low-privilege users to publish messages to any queue without proper write ACLs by abusing temporary composite destinations. This enables unauthorized message injection into restricted queues, potentially disrupting message integrity and business logic. No active exploitation or public exploit code has been identified.