Security Advisories - Artemis
Details of security problems fixed in released versions of Apache Artemis are detailed below.
See the main Security Advisories page for details for other components and general information such as reporting new security issues.
| CVE | Severity | Description | Affected Versions | Fixed In |
|---|---|---|---|---|
| CVE-2026-75880 | Moderate | Message selector wildcard handling could lead to denial of service | 1.0.0 - 2.56.0 | 2.57.0 |
| CVE-2026-67593 | Important | Pre-authentication Openwire protocol handling can result in queue deletion | 1.0.0 - 2.56.0 | 2.57.0 |
| CVE-2026-57967 | Important | Missing authentication on CORE protocol session reattachment | 1.0.0 - 2.56.0 | 2.57.0 |
| CVE-2026-57822 | Important | Message-based management parameter deserialization may lead to denial of service | 1.3.0 - 2.56.0 | 2.57.0 |
| CVE-2026-49364 | Important | Pre-Authentication Cluster Credential Exposure to Discovered Peers | 1.0.0 - 2.56.0 | 2.57.0 |
| CVE-2026-49363 | Moderate | Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription | 1.0.0 - 2.56.0 | 2.57.0 |
| CVE-2026-49362 | Important | Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation | 1.0.0 - 2.56.0 | 2.57.0 |
| CVE-2026-40914 | Low | Address routing-type can be updated by STOMP protocol user without the createAddress permission | 2.0.0 - 2.53.0 | 2.54.0 |
| CVE-2026-32642 | Low | Temporary address auto-created for OpenWire consumer without createAddress permission | 2.0.0 - 2.52.0 | 2.53.0 |
| CVE-2026-27446 | Critical | Auth bypass for Core downstream federation | 2.11.0 - 2.51.0 | 2.52.0 |
| CVE-2025-27391 | Moderate | Passwords leaking from broker properties in the debug log | 1.5.1 - 2.39.0 | 2.40.0 |
| CVE-2025-27427 | Low | Address routing-type can be updated by user without the createAddress permission | 2.0.0 - 2.39.0 | 2.40.0 |
| CVE-2023-50780 | Moderate | Authenticated users could perform RCE via Jolokia MBeans | < 2.29.0 | 2.29.0 |
| CVE-2022-35278 | Moderate | HTML Injection in ActiveMQ Artemis Web Console | < 2.24.0 | 2.24.0 |
| CVE-2022-23913 | High | Apache ActiveMQ Artemis DoS | < 2.19.1 | 2.19.1 |
| CVE-2021-26117 | High | LDAP-Authentication does not verify passwords on servers with anonymous bind | < 2.16.0 | 2.16.0 |
| CVE-2021-26118 | High | Flaw in ActiveMQ Artemis OpenWire support | < 2.15.0 | 2.16.0 |
| CVE-2020-13932 | Medium | Remote XSS in Web console Diagram Plugin | 2.5.0 - 2.13.0 | 2.14.0 |
| CVE-2017-12174 | High | Memory exhaustion via UDP and JGroups discovery | 1.0.0 - 2.3.0 | 1.5.6 / 2.4.0 |
| CVE-2016-4978 | Important | Deserialization of untrusted input vulnerability | 1.0.0 - 1.3.0 | 1.4.0 |
