GHSA-mhp6-f224-j2c3

Suggest an improvement
Source
https://github.com/advisories/GHSA-mhp6-f224-j2c3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mhp6-f224-j2c3
Aliases
Downstream
CGA (4)
MINI (4)
Published
2026-06-30T12:31:52Z
Modified
2026-11-05T17:55:55Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability
Details

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-05T17:36:18Z",
    "nvd_published_at": "2026-06-30T11:16:30Z",
    "severity": "HIGH"
}
References

Affected packages

Maven
org.apache.activemq:activemq-broker

Package

Name
org.apache.activemq:activemq-broker
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-broker

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.19.8

Affected versions

5.*
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.15.0
5.15.1
5.15.2
5.15.3
5.15.4
5.15.5
5.15.6
5.15.7
5.15.8
5.15.9
5.15.10
5.15.11
5.15.12
5.15.13
5.15.14
5.15.15
5.15.16
5.16.0
5.16.1
5.16.2
5.16.3
5.16.4
5.16.5
5.16.6
5.16.7
5.16.8
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.17.5
5.17.6
5.17.7
5.18.0
5.18.1
5.18.2
5.18.3
5.18.4
5.18.5
5.18.6
5.18.7
5.19.0
5.19.1
5.19.2
5.19.3
5.19.4
5.19.5
5.19.6
5.19.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json"
org.apache.activemq:activemq-broker

Package

Name
org.apache.activemq:activemq-broker
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-broker

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.2.7

Affected versions

6.*
6.0.0
6.0.1
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json"
org.apache.activemq:activemq-all

Package

Name
org.apache.activemq:activemq-all
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-all

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.19.8

Affected versions

4.*
4.1.2
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.4.3
5.5.0
5.5.1
5.6.0
5.7.0
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.15.0
5.15.1
5.15.2
5.15.3
5.15.4
5.15.5
5.15.6
5.15.7
5.15.8
5.15.9
5.15.10
5.15.11
5.15.12
5.15.13
5.15.14
5.15.15
5.15.16
5.16.0
5.16.1
5.16.2
5.16.3
5.16.4
5.16.5
5.16.6
5.16.7
5.16.8
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.17.5
5.17.6
5.17.7
5.18.0
5.18.1
5.18.2
5.18.3
5.18.4
5.18.5
5.18.6
5.18.7
5.19.0
5.19.1
5.19.2
5.19.3
5.19.4
5.19.5
5.19.6
5.19.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json"
org.apache.activemq:activemq-all

Package

Name
org.apache.activemq:activemq-all
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-all

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.2.7

Affected versions

6.*
6.0.0
6.0.1
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json"
org.apache.activemq:apache-activemq

Package

Name
org.apache.activemq:apache-activemq
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.19.8

Affected versions

4.*
4.1.1
4.1.2
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.4.3
5.5.0
5.5.1
5.6.0
5.7.0
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.15.0
5.15.1
5.15.2
5.15.3
5.15.4
5.15.5
5.15.6
5.15.7
5.15.8
5.15.9
5.15.10
5.15.11
5.15.12
5.15.13
5.15.14
5.15.15
5.15.16
5.16.0
5.16.1
5.16.2
5.16.3
5.16.4
5.16.5
5.16.6
5.16.7
5.16.8
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.17.5
5.17.6
5.17.7
5.18.0
5.18.1
5.18.2
5.18.3
5.18.4
5.18.5
5.18.6
5.18.7
5.19.0
5.19.1
5.19.2
5.19.3
5.19.4
5.19.5
5.19.6
5.19.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json"
org.apache.activemq:apache-activemq

Package

Name
org.apache.activemq:apache-activemq
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.2.7

Affected versions

6.*
6.0.0
6.0.1
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json"