This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Apache ActiveMQ fixes 4 vulnerabilities

The Apache Software Foundation fixes 4 vulnerabilities in Apache ActiveMQ products (Classic, All, Broker, Client, MQTT) with versions 5.19.5 and 6.2.4 [1][2][3][4]. The most severe of them are described below, with CVE-2026-34197 already being actively exploited [5].

Apache ActiveMQ, ActiveMQ All & Broker - RCE (CVE-2026-34197)
CVSS 8.8 (High)

An authenticated remote attacker can, under certain conditions, execute code on the system via the Jolokia API interface in the Broker component of Apache ActiveMQ (including the All distribution) [1][6]. Exploitation of this vulnerability is made significantly easier by the use of default credentials and also by the complete absence of authentication in some versions of the 6 series [7]. Detailed information about the vulnerability can be found at [1][6].

The vulnerability is present in products:

  • Apache ActiveMQ; <5.19.4; >=6.0.0, <6.2.3;
  • Apache ActiveMQ Broker; <5.19.4; >=6.0.0, <6.2.3;
  • Apache ActiveMQ All; <5.19.4; >=6.0.0, <6.2.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 7. 4. 2026.

Apache ActiveMQ, ActiveMQ Broker & Client - DoS (CVE-2026-39304)
CVSS 7.5 (High)

An unauthenticated remote attacker can carry out a DoS attack in Apache ActiveMQ (both the Broker and Client components) within NIO SSL transports by sending TLSv1.3 KeyUpdate messages [2][8].

The vulnerability is present in products:

  • Apache ActiveMQ; <5.19.4; >=6.0.0, <6.2.4;
  • Apache ActiveMQ Broker; <5.19.4; >=6.0.0, <6.2.4;
  • Apache ActiveMQ Client; <5.19.4; >=6.0.0, <6.2.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 10. 4. 2026.

Apache ActiveMQ, ActiveMQ All & MQTT - DoS (CVE-2026-40046)
CVSS 7.5 (High)

An unauthenticated remote attacker can carry out a DoS attack in Apache ActiveMQ (including the All distribution and specifically in the MQTT protocol module) by sending a specially crafted MQTT control packet [3][9]. This vulnerability is a regression of the earlier bug CVE-2025-66168 [10].

The vulnerability is present in products:

  • Apache ActiveMQ; <5.19.2; >=6.0.0, <6.2.4;
  • Apache ActiveMQ All; <5.19.2; >=6.0.0, <6.2.4;
  • Apache ActiveMQ MQTT; <5.19.2; >=6.0.0, <6.2.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 10. 4. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 22. 4. 2026.

CESNET, z.s.p.o. Logo