Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-30T09:55:29 org.apache.activemq/activemq-broker: org.apache.activemq/activemq-core: org.apache.activemq/activemq-all: Apache ActiveMQ: Unauthorized broker instantiation via improper input validation in LDAP entries 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H CWE-90

Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

A flaw was found in Apache ActiveMQ. An attacker with privileges to publish or modify entries in Lightweight Directory Access Protocol (LDAP) can exploit an improper input validation vulnerability. This allows the attacker to instantiate denied transports within the broker's Java Virtual Machine (JVM). Consequently, this can be used to fetch an attacker-controlled URL and launch an additional BrokerService within the same JVM, potentially leading to a denial of service or further system compromise.

Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. The vulnerability is in the LdapNetworkConnector feature specific to Classic ActiveMQ, which allows an attacker with LDAP write access to instantiate denied transports and spawn a rogue broker. This feature is not configured or used in any Red Hat product deployment. Red Hat AMQ Broker is based on Apache ActiveMQ Artemis, a separate codebase that does not include the LdapNetworkConnector. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat AMQ Broker 7 Fix deferred activemq-artemis-native Red Hat AMQ Broker 7 Fix deferred activemq-broker Red Hat AMQ Broker 7 Fix deferred activemq-client Red Hat AMQ Broker 7 Fix deferred activemq-openwire-legacy Red Hat AMQ Broker 7 Fix deferred apache-artemis Red Hat AMQ Broker 7 Fix deferred artemis-amqp-protocol Red Hat AMQ Broker 7 Fix deferred artemis-boot Red Hat AMQ Broker 7 Fix deferred artemis-cli Red Hat AMQ Broker 7 Fix deferred artemis-commons Red Hat AMQ Broker 7 Fix deferred artemis-console Red Hat AMQ Broker 7 Fix deferred artemis-console-war Red Hat AMQ Broker 7 Fix deferred artemis-core-client Red Hat AMQ Broker 7 Fix deferred artemis-dto Red Hat AMQ Broker 7 Fix deferred artemis-hornetq-protocol Red Hat AMQ Broker 7 Fix deferred artemis-hqclient-protocol Red Hat AMQ Broker 7 Fix deferred artemis-jdbc-store Red Hat AMQ Broker 7 Fix deferred artemis-jms-client Red Hat AMQ Broker 7 Fix deferred artemis-jms-server Red Hat AMQ Broker 7 Fix deferred artemis-journal Red Hat AMQ Broker 7 Fix deferred artemis-lockmanager-api Red Hat AMQ Broker 7 Fix deferred artemis-lockmanager-ri Red Hat AMQ Broker 7 Fix deferred artemis-mqtt-protocol Red Hat AMQ Broker 7 Fix deferred artemis-openwire-protocol Red Hat AMQ Broker 7 Fix deferred artemis-ra Red Hat AMQ Broker 7 Fix deferred artemis-selector Red Hat AMQ Broker 7 Fix deferred artemis-server Red Hat AMQ Broker 7 Fix deferred artemis-service-extensions Red Hat AMQ Broker 7 Fix deferred artemis-stomp-protocol Red Hat AMQ Broker 7 Fix deferred artemis-web Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-aarch64 Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-i686 Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-ppc64le Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-s390x Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-x86_64 Red Hat AMQ Clients Fix deferred activemq-artemis-native Red Hat AMQ Clients Fix deferred artemis-amqp-protocol Red Hat AMQ Clients Fix deferred artemis-commons Red Hat AMQ Clients Fix deferred artemis-core-client Red Hat AMQ Clients Fix deferred artemis-jdbc-store Red Hat AMQ Clients Fix deferred artemis-journal Red Hat AMQ Clients Fix deferred artemis-lockmanager-api Red Hat AMQ Clients Fix deferred artemis-selector Red Hat AMQ Clients Fix deferred artemis-server Red Hat build of Apache Camel for Spring Boot 4 Fix deferred activemq-artemis-native Red Hat build of Apache Camel for Spring Boot 4 Fix deferred artemis-mqtt-protocol Red Hat build of Apache Camel for Spring Boot 4 Fix deferred artemis-relocations-parent Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-aarch64 Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-i686 Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-ppc64le Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-s390x Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-x86_64 Red Hat Data Grid 8 Fix deferred activemq-broker Red Hat Data Grid 8 Fix deferred zipkin-sender-activemq-client Red Hat Enterprise Linux 8 Fix deferred log4j:2/log4j Red Hat Fuse 7 Fix deferred activeio-core Red Hat Fuse 7 Fix deferred activemq-all Red Hat Fuse 7 Fix deferred activemq-broker Red Hat Fuse 7 Fix deferred activemq-client Red Hat Fuse 7 Fix deferred activemq-console Red Hat Fuse 7 Fix deferred activemq-http Red Hat Fuse 7 Fix deferred activemq-jms-pool Red Hat Fuse 7 Fix deferred activemq-kahadb-store Red Hat Fuse 7 Fix deferred activemq-karaf Red Hat Fuse 7 Fix deferred activemq-log4j-appender Red Hat Fuse 7 Fix deferred activemq-mqtt Red Hat Fuse 7 Fix deferred activemq-openwire-legacy Red Hat Fuse 7 Fix deferred activemq-osgi Red Hat Fuse 7 Fix deferred activemq-pool Red Hat Fuse 7 Fix deferred activemq-protobuf Red Hat Fuse 7 Fix deferred activemq-spring Red Hat Fuse 7 Fix deferred activemq-stomp Red Hat JBoss Enterprise Application Platform 7 Fix deferred wildfly-messaging-activemq Red Hat JBoss Enterprise Application Platform 8 Fix deferred activemq-artemis-native Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-cli Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-commons Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-core-client Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-dto Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-hornetq-protocol Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-hqclient-protocol Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-client Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-ra Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-server Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-service-extensions Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jdbc-store Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-journal Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-selector Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-server Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-wildfly-integration Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-aarch64 Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-i686 Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-ppc64le Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-s390x Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-x86_64 Red Hat JBoss Enterprise Application Platform 8 Fix deferred wildfly-messaging-activemq-injection Red Hat JBoss Enterprise Application Platform 8 Fix deferred wildfly-messaging-activemq-subsystem Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred activemq-broker Red Hat Satellite 6 Fix deferred candlepin Red Hat Satellite 6 Fix deferred satellite:el8/candlepin Red Hat Single Sign-On 7 Fix deferred activemq-artemis-native Red Hat Single Sign-On 7 Fix deferred artemis-cli Red Hat Single Sign-On 7 Fix deferred artemis-commons Red Hat Single Sign-On 7 Fix deferred artemis-core-client Red Hat Single Sign-On 7 Fix deferred artemis-dto Red Hat Single Sign-On 7 Fix deferred artemis-hornetq-protocol Red Hat Single Sign-On 7 Fix deferred artemis-hqclient-protocol Red Hat Single Sign-On 7 Fix deferred artemis-jdbc-store Red Hat Single Sign-On 7 Fix deferred artemis-jms-client Red Hat Single Sign-On 7 Fix deferred artemis-jms-server Red Hat Single Sign-On 7 Fix deferred artemis-journal Red Hat Single Sign-On 7 Fix deferred artemis-ra Red Hat Single Sign-On 7 Fix deferred artemis-selector Red Hat Single Sign-On 7 Fix deferred artemis-server Red Hat Single Sign-On 7 Fix deferred artemis-service-extensions Red Hat Single Sign-On 7 Fix deferred artemis-tools Red Hat Single Sign-On 7 Fix deferred artemis-wildfly-integration Red Hat Single Sign-On 7 Fix deferred libartemis-native-linux-i686 Red Hat Single Sign-On 7 Fix deferred libartemis-native-linux-x86_64 Red Hat Single Sign-On 7 Fix deferred wildfly-messaging-activemq https://www.cve.org/CVERecord?id=CVE-2026-49434 https://nvd.nist.gov/vuln/detail/CVE-2026-49434 https://lists.apache.org/thread/hcjh7kdk4l85tb9ksmvcnkhso1ngj50o