GHSA-h2h4-5m64-m273

Suggest an improvement
Source
https://github.com/advisories/GHSA-h2h4-5m64-m273
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-h2h4-5m64-m273/GHSA-h2h4-5m64-m273.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h2h4-5m64-m273
Aliases
Downstream
CGA (42)
MINI (6)
Published
2026-04-07T09:31:22Z
Modified
2026-09-10T03:50:44Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Apache ActiveMQ: Improper validation and restriction of a classpath path name
Details

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.

In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.

Database specific 
{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-08T15:04:05Z",
    "nvd_published_at":  "2026-04-07T09:16:20Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven
org.apache.activemq:activemq-client

Package

Name
org.apache.activemq:activemq-client
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.19.3

Affected versions

5.*
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.15.0
5.15.1
5.15.2
5.15.3
5.15.4
5.15.5
5.15.6
5.15.7
5.15.8
5.15.9
5.15.10
5.15.11
5.15.12
5.15.13
5.15.14
5.15.15
5.15.16
5.16.0
5.16.1
5.16.2
5.16.3
5.16.4
5.16.5
5.16.6
5.16.7
5.16.8
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.17.5
5.17.6
5.17.7
5.18.0
5.18.1
5.18.2
5.18.3
5.18.4
5.18.5
5.18.6
5.18.7
5.19.0
5.19.1
5.19.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-h2h4-5m64-m273/GHSA-h2h4-5m64-m273.json"
org.apache.activemq:activemq-client

Package

Name
org.apache.activemq:activemq-client
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.2.2

Affected versions

6.*
6.0.0
6.0.1
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.2.0
6.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-h2h4-5m64-m273/GHSA-h2h4-5m64-m273.json"
org.apache.activemq:activemq-broker

Package

Name
org.apache.activemq:activemq-broker
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-broker

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.19.3

Affected versions

5.*
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.15.0
5.15.1
5.15.2
5.15.3
5.15.4
5.15.5
5.15.6
5.15.7
5.15.8
5.15.9
5.15.10
5.15.11
5.15.12
5.15.13
5.15.14
5.15.15
5.15.16
5.16.0
5.16.1
5.16.2
5.16.3
5.16.4
5.16.5
5.16.6
5.16.7
5.16.8
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.17.5
5.17.6
5.17.7
5.18.0
5.18.1
5.18.2
5.18.3
5.18.4
5.18.5
5.18.6
5.18.7
5.19.0
5.19.1
5.19.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-h2h4-5m64-m273/GHSA-h2h4-5m64-m273.json"
org.apache.activemq:activemq-broker

Package

Name
org.apache.activemq:activemq-broker
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-broker

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.2.2

Affected versions

6.*
6.0.0
6.0.1
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.2.0
6.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-h2h4-5m64-m273/GHSA-h2h4-5m64-m273.json"
org.apache.activemq:activemq-all

Package

Name
org.apache.activemq:activemq-all
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-all

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.19.3

Affected versions

4.*
4.1.2
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.4.3
5.5.0
5.5.1
5.6.0
5.7.0
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.15.0
5.15.1
5.15.2
5.15.3
5.15.4
5.15.5
5.15.6
5.15.7
5.15.8
5.15.9
5.15.10
5.15.11
5.15.12
5.15.13
5.15.14
5.15.15
5.15.16
5.16.0
5.16.1
5.16.2
5.16.3
5.16.4
5.16.5
5.16.6
5.16.7
5.16.8
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.17.5
5.17.6
5.17.7
5.18.0
5.18.1
5.18.2
5.18.3
5.18.4
5.18.5
5.18.6
5.18.7
5.19.0
5.19.1
5.19.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-h2h4-5m64-m273/GHSA-h2h4-5m64-m273.json"
org.apache.activemq:activemq-all

Package

Name
org.apache.activemq:activemq-all
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-all

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.2.2

Affected versions

6.*
6.0.0
6.0.1
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.2.0
6.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-h2h4-5m64-m273/GHSA-h2h4-5m64-m273.json"
org.apache.activemq:activemq-web

Package

Name
org.apache.activemq:activemq-web
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.19.3

Affected versions

4.*
4.1.1
4.1.2
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.4.3
5.5.0
5.5.1
5.6.0
5.7.0
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.15.0
5.15.1
5.15.2
5.15.3
5.15.4
5.15.5
5.15.6
5.15.7
5.15.8
5.15.9
5.15.10
5.15.11
5.15.12
5.15.13
5.15.14
5.15.15
5.15.16
5.16.0
5.16.1
5.16.2
5.16.3
5.16.4
5.16.5
5.16.6
5.16.7
5.16.8
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.17.5
5.17.6
5.17.7
5.18.0
5.18.1
5.18.2
5.18.3
5.18.4
5.18.5
5.18.6
5.18.7
5.19.0
5.19.1
5.19.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-h2h4-5m64-m273/GHSA-h2h4-5m64-m273.json"
org.apache.activemq:activemq-web

Package

Name
org.apache.activemq:activemq-web
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.2.2

Affected versions

6.*
6.0.0
6.0.1
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.2.0
6.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-h2h4-5m64-m273/GHSA-h2h4-5m64-m273.json"