renovate-bot opened a new pull request, #6688:
URL: https://github.com/apache/jmeter/pull/6688

   This PR contains the following updates:
   
   | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | 
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
   |---|---|---|---|
   | [org.apache.activemq:activemq-broker](http://activemq.apache.org) 
([source](https://redirect.github.com/apache/activemq)) | `6.2.0` → `6.2.4` | 
![age](https://developer.mend.io/api/mc/badges/age/maven/org.apache.activemq:activemq-broker/6.2.4?slim=true)
 | 
![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/org.apache.activemq:activemq-broker/6.2.0/6.2.4?slim=true)
 |
   
   ### GitHub Vulnerability Alerts
   
   #### [CVE-2026-33227](https://nvd.nist.gov/vuln/detail/CVE-2026-33227)
   
   Improper validation and restriction of a classpath path name vulnerability 
in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache 
ActiveMQ Web, Apache ActiveMQ.
   
   In two instances (when creating a Stomp consumer and also browsing messages 
in the Web console) an authenticated user provided "key" value could be 
constructed to traverse the classpath due to path concatenation. As a result, 
the application is exposed to a classpath path resource loading vulnerability 
that could potentially be chained together with another attack to lead to 
exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 
before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; 
Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ 
Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, 
from 6.0.0 before 6.2.2.
   
   Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the 
issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to 
non-Windows environments due to a path separator resolution bug fixed in 5.19.4 
and 6.2.3.
   
   ##### Severity
   - CVSS Score: 4.3 / 10 (Medium)
   - Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`
   
   #### [CVE-2026-39304](https://nvd.nist.gov/vuln/detail/CVE-2026-39304)
   
   Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, 
Apache ActiveMQ Broker, Apache ActiveMQ.
   
   ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake 
KeyUpdates triggered by clients. This makes it possible for a client to rapidly 
trigger updates which causes the broker to exhaust all its memory in the SSL 
engine leading to DoS.
   
   Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not 
vulnerable to OOM. Previous TLS versions require a full handshake renegotiation 
which causes a connection to hang but not OOM. This is fixed as well.
   This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 
6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache 
ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.
   
   Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the 
issue.
   
   ##### Severity
   - CVSS Score: 7.5 / 10 (High)
   - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
   
   #### [CVE-2026-34197](https://nvd.nist.gov/vuln/detail/CVE-2026-34197)
   
   Improper Input Validation, Improper Control of Generation of Code ('Code 
Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
   
   Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ 
on the web console. The default Jolokia access policy permits exec operations 
on all ActiveMQ MBeans (org.apache.activemq:*), including
   BrokerService.addNetworkConnector(String) and 
BrokerService.addConnector(String). 
   
   An authenticated attacker can invoke these operations with a crafted 
discovery URI that triggers the VM transport's brokerConfig parameter to load a 
remote Spring XML application context using ResourceXmlApplicationContext. 
   Because Spring's ResourceXmlApplicationContext instantiates all singleton 
beans before the BrokerService validates the configuration, arbitrary code 
execution occurs on the broker's JVM through bean factory methods such as 
Runtime.exec().
   This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 
6.2.3; Apache ActiveMQ: .
   
   Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the 
issue.
   
   ##### Severity
   - CVSS Score: 8.8 / 10 (High)
   - Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
   
   ---
   
   ### Configuration
   
   📅 **Schedule**: (UTC)
   
   - Branch creation
     - ""
   - Automerge
     - At any time (no schedule defined)
   
   🚦 **Automerge**: Disabled by config. Please merge this manually once you are 
satisfied.
   
   ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry 
checkbox.
   
   🔕 **Ignore**: Close this PR and you won't be reminded about this update 
again.
   
   ---
   
    - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this 
box
   
   ---
   
   This PR was generated by [Mend Renovate](https://mend.io/renovate/). View 
the [repository job log](https://developer.mend.io/github/apache/jmeter).
   
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjEyMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to