This is an automated email from the ASF dual-hosted git repository.
cshannon pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/activemq-website.git
The following commit(s) were added to refs/heads/main by this push:
new 89523a91c Add new CVEs
89523a91c is described below
commit 89523a91cb31870ded8d811519fcc7cf7ad77fe9
Author: Christopher L. Shannon <[email protected]>
AuthorDate: Mon Jul 27 13:22:58 2026 -0400
Add new CVEs
---
src/components/classic/security.md | 2 ++
.../CVE-2026-59878-announcement.txt | 28 ++++++++++++++++++++
.../CVE-2026-61487-announcement.txt | 30 ++++++++++++++++++++++
3 files changed, 60 insertions(+)
diff --git a/src/components/classic/security.md
b/src/components/classic/security.md
index 78e0ad0cf..a3e2bbeb7 100644
--- a/src/components/classic/security.md
+++ b/src/components/classic/security.md
@@ -9,6 +9,8 @@ Details of security problems fixed in released versions of
Apache ActiveMQ 6.x a
See the main [Security Advisories](../../security-advisories) page for details
for other components and general information such as reporting new security
issues.
+*
[CVE-2026-61487](../../security-advisories.data/CVE-2026-61487-announcement.txt)
- Authorization bypass via temporary composite destinations
+*
[CVE-2026-59878](../../security-advisories.data/CVE-2026-59878-announcement.txt)
- AMQP NIO negative frame size validation bypass leading to DoS
*
[CVE-2026-54475](../../security-advisories.data/CVE-2026-54475-announcement.txt)
- Temporary destination ownership takeover
*
[CVE-2026-53917](../../security-advisories.data/CVE-2026-53917-announcement.txt)
- Unbounded memory allocation in OpenWire property unmarshalling
*
[CVE-2026-53916](../../security-advisories.data/CVE-2026-49157-announcement.txt)
- Unbounded header buffer in STOMP NIO codec
diff --git a/src/security-advisories.data/CVE-2026-59878-announcement.txt
b/src/security-advisories.data/CVE-2026-59878-announcement.txt
new file mode 100644
index 000000000..1f826eeec
--- /dev/null
+++ b/src/security-advisories.data/CVE-2026-59878-announcement.txt
@@ -0,0 +1,28 @@
+Severity: moderate
+
+Affected versions:
+
+- Apache ActiveMQ AMQP (org.apache.activemq:activemq-amqp) before 5.19.9
+- Apache ActiveMQ AMQP (org.apache.activemq:activemq-amqp) 6.0.0 before 6.2.8
+- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.9
+- Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.8
+- Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.9
+- Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.8
+
+Description:
+
+Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache
ActiveMQ, Apache ActiveMQ All.
+
+A remote unauthenticated peer that can reach an exposed AMQP NIO connector can
trigger denial-of-service behavior by sending a frame size value. This cause
the NIO threads to die and if done rapidly enough can lead to exhaustion of the
NIO thread pool denying service to other connections.
+This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before
6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ
All: before 5.19.9, from 6.0.0 before 6.2.8.
+
+Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which
fixes the issue.
+
+Credit:
+
+zx (Jace) (finder)
+
+References:
+
+https://activemq.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-59878
diff --git a/src/security-advisories.data/CVE-2026-61487-announcement.txt
b/src/security-advisories.data/CVE-2026-61487-announcement.txt
new file mode 100644
index 000000000..3029c0578
--- /dev/null
+++ b/src/security-advisories.data/CVE-2026-61487-announcement.txt
@@ -0,0 +1,30 @@
+Severity: important
+
+Affected versions:
+
+- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.9
+- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before
6.2.8
+- Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.9
+- Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.8
+- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.9
+- Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.8
+
+Description:
+
+Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache
ActiveMQ All, Apache ActiveMQ.
+
+ An authenticated low-privilege user can bypass a per-destination
+write ACL by sending to an ActiveMQ temporary composite destination whose
physical name is a
+comma-separated composite of real queues. This allows publishing messages to
any of the destinations in the list without proper write ACL permissions
because the authorization check is bypassed due to the composite destination
being marked as temporary.
+This issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before
6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache
ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8.
+
+Users are recommended to upgrade to version 5.19.9, 6.2.8 or 6.3.0, which
fixes the issue.
+
+Credit:
+
+Claude and Ada Logics (finder)
+
+References:
+
+https://activemq.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-61487
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
For further information, visit: https://activemq.apache.org/contact
