CVE-2026-49434
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker
Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Apache ActiveMQ Broker
- Vendor
- Apache Software Foundation
- Product
- Apache ActiveMQ Broker
- Platforms
- Unknown
- Default status
unaffected- Package
- org.apache.activemq:activemq-broker
- Package collection
- https://repo.maven.apache.org/maven2
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 5.19.8 | Unavailable | None listed |
| 6.0.0 | affected | semver | 6.2.7 | Unavailable | None listed |
Apache ActiveMQ
- Vendor
- Apache Software Foundation
- Product
- Apache ActiveMQ
- Platforms
- Unknown
- Default status
unaffected- Package
- org.apache.activemq:apache-activemq
- Package collection
- https://repo.maven.apache.org/maven2
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 5.19.8 | Unavailable | None listed |
| 6.0.0 | affected | semver | 6.2.7 | Unavailable | None listed |
Apache ActiveMQ All
- Vendor
- Apache Software Foundation
- Product
- Apache ActiveMQ All
- Platforms
- Unknown
- Default status
unaffected- Package
- org.apache.activemq:activemq-all
- Package collection
- https://repo.maven.apache.org/maven2
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 5.19.8 | Unavailable | None listed |
| 6.0.0 | affected | semver | 6.2.7 | Unavailable | None listed |