OESA-2026-3266

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3266
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-3266.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-3266
Upstream
Published
2026-08-07T02:42:48Z
Modified
2026-08-07T03:00:52.839234070Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
activemq security update
Details

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All.

A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done rapidly enough can lead to exhaustion of the NIO thread pool denying service to other connections. This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8.

Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which fixes the issue.(CVE-2026-59878)

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real queues. This allows publishing messages to any of the destinations in the list without proper write ACL permissions because the authorization check is bypassed due to the composite destination being marked as temporary. This issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8.

Users are recommended to upgrade to version 5.19.9, 6.2.8 or 6.3.0, which fixes the issue.(CVE-2026-61487)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:24.03-LTS-SP3 / activemq

Package

Name
activemq
Purl
pkg:rpm/openEuler/activemq&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.19.9-1.oe2403sp3

Ecosystem specific 

{
    "src": [
        "activemq-5.19.9-1.oe2403sp3.src.rpm"
    ],
    "noarch": [
        "activemq-5.19.9-1.oe2403sp3.noarch.rpm",
        "activemq-javadoc-5.19.9-1.oe2403sp3.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3266.json"