Apache Activemq Artemis
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Apache Activemq Artemis.
By the Year
In 2025 there have been 2 vulnerabilities in Apache Activemq Artemis with an average score of 5.4 out of ten. Last year, in 2024 Activemq Artemis had 1 security vulnerability published. That is, 1 more vulnerability have already been reported in 2025 as compared to last year. Last year, the average CVE base score was greater by 3.40
Year | Vulnerabilities | Average Score |
---|---|---|
2025 | 2 | 5.40 |
2024 | 1 | 8.80 |
2023 | 0 | 0.00 |
2022 | 3 | 6.30 |
2021 | 2 | 7.50 |
2020 | 1 | 5.50 |
2019 | 0 | 0.00 |
2018 | 1 | 7.50 |
It may take a day or so for new Activemq Artemis vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Activemq Artemis Security Vulnerabilities
Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis
CVE-2025-27391
6.5 - Medium
- April 09, 2025
Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.
Insertion of Sensitive Information into Log File
A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by
CVE-2025-27427
4.3 - Medium
- April 01, 2025
A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0. Users are recommended to upgrade to version 2.40.0 which fixes the issue.
AuthZ
Apache ActiveMQ Artemis RCE via MBeans or Jolokia endpoint
CVE-2023-50780
8.8 - High
- October 14, 2024
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
A flaw was found in AMQ Broker
CVE-2021-4040
5.3 - Medium
- August 24, 2022
A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.
Memory Corruption
In Apache ActiveMQ Artemis prior to 2.24.0
CVE-2022-35278
6.1 - Medium
- August 23, 2022
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
XSS
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1
CVE-2022-23913
7.5 - High
- February 04, 2022
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
Allocation of Resources Without Limits or Throttling
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server
CVE-2021-26117
7.5 - High
- January 27, 2021
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
authentification
While investigating ARTEMIS-2964 it was found
CVE-2021-26118
7.5 - High
- January 27, 2021
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
A flaw was found in ActiveMQ Artemis management API
CVE-2020-10727
5.5 - Medium
- June 26, 2020
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
Cleartext Storage of Sensitive Information
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message
CVE-2017-12174
7.5 - High
- March 07, 2018
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.
Resource Exhaustion
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might
CVE-2016-4978
7.2 - High
- September 27, 2016
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
Marshaling, Unmarshaling
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Activemq Artemis or by Apache? Click the Watch button to subscribe.
