Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.activemq/apache-activemq@5.12.3
Typemaven
Namespaceorg.apache.activemq
Nameapache-activemq
Version5.12.3
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.19.6
Latest_non_vulnerable_version6.2.5
Affected_by_vulnerabilities
0
url VCID-3a83-kwkc-13dq
vulnerability_id VCID-3a83-kwkc-13dq
summary 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.

This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41043.json
reference_id
reference_type
scores
0
value 4.6
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41043.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-41043
reference_id
reference_type
scores
0
value 0.00241
scoring_system epss
scoring_elements 0.47653
published_at 2026-06-11T12:55:00Z
1
value 0.00241
scoring_system epss
scoring_elements 0.47793
published_at 2026-06-12T12:55:00Z
2
value 0.00241
scoring_system epss
scoring_elements 0.47809
published_at 2026-06-13T12:55:00Z
3
value 0.00241
scoring_system epss
scoring_elements 0.4779
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-41043
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41043
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41043
3
reference_url https://github.com/apache/activemq
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/activemq
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-41043
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-41043
5
reference_url http://www.openwall.com/lists/oss-security/2026/04/23/5
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/23/5
6
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136024
reference_id 1136024
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136024
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2461407
reference_id 2461407
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2461407
8
reference_url https://activemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt
reference_id CVE-2026-41043-announcement.txt
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-24T18:05:08Z/
url https://activemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt
9
reference_url https://github.com/advisories/GHSA-2jp3-2923-9h52
reference_id GHSA-2jp3-2923-9h52
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-2jp3-2923-9h52
fixed_packages
0
url pkg:maven/org.apache.activemq/apache-activemq@5.19.6
purl pkg:maven/org.apache.activemq/apache-activemq@5.19.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@5.19.6
1
url pkg:maven/org.apache.activemq/apache-activemq@6.2.5
purl pkg:maven/org.apache.activemq/apache-activemq@6.2.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@6.2.5
aliases CVE-2026-41043, GHSA-2jp3-2923-9h52
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3a83-kwkc-13dq
1
url VCID-92hs-e8rr-yke5
vulnerability_id VCID-92hs-e8rr-yke5
summary 
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well.
This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-39304.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-39304.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-39304
reference_id
reference_type
scores
0
value 0.00056
scoring_system epss
scoring_elements 0.17908
published_at 2026-06-11T12:55:00Z
1
value 0.00056
scoring_system epss
scoring_elements 0.18067
published_at 2026-06-12T12:55:00Z
2
value 0.00056
scoring_system epss
scoring_elements 0.18083
published_at 2026-06-13T12:55:00Z
3
value 0.00056
scoring_system epss
scoring_elements 0.18059
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-39304
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39304
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39304
3
reference_url https://github.com/apache/activemq
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/activemq
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-39304
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-39304
5
reference_url http://www.openwall.com/lists/oss-security/2026/04/09/17
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/09/17
6
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136024
reference_id 1136024
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136024
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457275
reference_id 2457275
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457275
8
reference_url https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt
reference_id CVE-2026-39304-announcement.txt
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T14:10:10Z/
url https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt
9
reference_url https://github.com/advisories/GHSA-5568-6qcg-g7fx
reference_id GHSA-5568-6qcg-g7fx
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-5568-6qcg-g7fx
fixed_packages
0
url pkg:maven/org.apache.activemq/apache-activemq@5.19.4
purl pkg:maven/org.apache.activemq/apache-activemq@5.19.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3a83-kwkc-13dq
1
vulnerability VCID-nv1w-jgty-yyfk
2
vulnerability VCID-umda-53ec-dkd7
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@5.19.4
1
url pkg:maven/org.apache.activemq/apache-activemq@6.2.4
purl pkg:maven/org.apache.activemq/apache-activemq@6.2.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3a83-kwkc-13dq
1
vulnerability VCID-nv1w-jgty-yyfk
2
vulnerability VCID-umda-53ec-dkd7
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@6.2.4
aliases CVE-2026-39304, GHSA-5568-6qcg-g7fx
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-92hs-e8rr-yke5
2
url VCID-nv1w-jgty-yyfk
vulnerability_id VCID-nv1w-jgty-yyfk
summary 
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.



An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().


This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40466.json
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40466.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-40466
reference_id
reference_type
scores
0
value 0.18014
scoring_system epss
scoring_elements 0.95334
published_at 2026-06-14T12:55:00Z
1
value 0.18014
scoring_system epss
scoring_elements 0.95312
published_at 2026-06-11T12:55:00Z
2
value 0.18014
scoring_system epss
scoring_elements 0.95327
published_at 2026-06-12T12:55:00Z
3
value 0.18014
scoring_system epss
scoring_elements 0.95333
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-40466
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40466
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40466
3
reference_url https://github.com/apache/activemq
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/activemq
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-40466
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-40466
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136024
reference_id 1136024
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136024
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2461410
reference_id 2461410
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2461410
7
reference_url https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
reference_id CVE-2026-34197-announcement.txt
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-27T13:37:05Z/
url https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
8
reference_url https://github.com/advisories/GHSA-w3w2-mpp5-92gm
reference_id GHSA-w3w2-mpp5-92gm
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-w3w2-mpp5-92gm
fixed_packages
0
url pkg:maven/org.apache.activemq/apache-activemq@5.19.6
purl pkg:maven/org.apache.activemq/apache-activemq@5.19.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@5.19.6
1
url pkg:maven/org.apache.activemq/apache-activemq@6.2.5
purl pkg:maven/org.apache.activemq/apache-activemq@6.2.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@6.2.5
aliases CVE-2026-40466, GHSA-w3w2-mpp5-92gm
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nv1w-jgty-yyfk
3
url VCID-umda-53ec-dkd7
vulnerability_id VCID-umda-53ec-dkd7
summary 
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All.

An authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application.
The attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file.


Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41044.json
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41044.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-41044
reference_id
reference_type
scores
0
value 0.00073
scoring_system epss
scoring_elements 0.22467
published_at 2026-06-14T12:55:00Z
1
value 0.00073
scoring_system epss
scoring_elements 0.22281
published_at 2026-06-11T12:55:00Z
2
value 0.00073
scoring_system epss
scoring_elements 0.22475
published_at 2026-06-12T12:55:00Z
3
value 0.00073
scoring_system epss
scoring_elements 0.22487
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-41044
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41044
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41044
3
reference_url https://github.com/apache/activemq
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/activemq
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-41044
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-41044
5
reference_url http://www.openwall.com/lists/oss-security/2026/04/23/6
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/23/6
6
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136024
reference_id 1136024
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136024
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2461409
reference_id 2461409
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2461409
8
reference_url https://activemq.apache.org/security-advisories.data/CVE-2026-41044-announcement.txt
reference_id CVE-2026-41044-announcement.txt
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-24T18:22:17Z/
url https://activemq.apache.org/security-advisories.data/CVE-2026-41044-announcement.txt
9
reference_url https://github.com/advisories/GHSA-mr6m-xj7v-3cv3
reference_id GHSA-mr6m-xj7v-3cv3
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mr6m-xj7v-3cv3
fixed_packages
0
url pkg:maven/org.apache.activemq/apache-activemq@5.19.6
purl pkg:maven/org.apache.activemq/apache-activemq@5.19.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@5.19.6
1
url pkg:maven/org.apache.activemq/apache-activemq@6.2.5
purl pkg:maven/org.apache.activemq/apache-activemq@6.2.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@6.2.5
aliases CVE-2026-41044, GHSA-mr6m-xj7v-3cv3
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-umda-53ec-dkd7
4
url VCID-xuvk-6evd-hqht
vulnerability_id VCID-xuvk-6evd-hqht
summary Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-41678.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-41678.json
1
reference_url https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-41678
reference_id
reference_type
scores
0
value 0.93
scoring_system epss
scoring_elements 0.99789
published_at 2026-06-13T12:55:00Z
1
value 0.93
scoring_system epss
scoring_elements 0.9979
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-41678
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41678
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41678
4
reference_url https://github.com/apache/activemq
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/activemq
5
reference_url https://github.com/apache/activemq/commit/5c8d457d9
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/activemq/commit/5c8d457d9
6
reference_url https://github.com/apache/activemq/commit/6120169e563b55323352431dfe9ac67a8b4de6c2
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/activemq/commit/6120169e563b55323352431dfe9ac67a8b4de6c2
7
reference_url https://github.com/apache/activemq/commit/bf65929fd
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/activemq/commit/bf65929fd
8
reference_url https://github.com/apache/activemq/commit/d8ce1d9ff
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/activemq/commit/d8ce1d9ff
9
reference_url https://github.com/apache/activemq/pull/958
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/activemq/pull/958
10
reference_url https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl
11
reference_url https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-41678
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-41678
13
reference_url https://security.netapp.com/advisory/ntap-20240216-0004
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20240216-0004
14
reference_url https://www.openwall.com/lists/oss-security/2023/11/28/1
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.openwall.com/lists/oss-security/2023/11/28/1
15
reference_url http://www.openwall.com/lists/oss-security/2023/11/28/1
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2023/11/28/1
16
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2252185
reference_id 2252185
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2252185
17
reference_url https://github.com/advisories/GHSA-53v4-42fg-g287
reference_id GHSA-53v4-42fg-g287
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-53v4-42fg-g287
18
reference_url https://access.redhat.com/errata/RHSA-2024:2944
reference_id RHSA-2024:2944
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2944
19
reference_url https://access.redhat.com/errata/RHSA-2024:2945
reference_id RHSA-2024:2945
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:2945
20
reference_url https://access.redhat.com/errata/RHSA-2024:3354
reference_id RHSA-2024:3354
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:3354
21
reference_url https://usn.ubuntu.com/6910-1/
reference_id USN-6910-1
reference_type
scores
url https://usn.ubuntu.com/6910-1/
22
reference_url https://usn.ubuntu.com/7268-1/
reference_id USN-7268-1
reference_type
scores
url https://usn.ubuntu.com/7268-1/
fixed_packages
0
url pkg:maven/org.apache.activemq/apache-activemq@5.16.6
purl pkg:maven/org.apache.activemq/apache-activemq@5.16.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3a83-kwkc-13dq
1
vulnerability VCID-92hs-e8rr-yke5
2
vulnerability VCID-nv1w-jgty-yyfk
3
vulnerability VCID-umda-53ec-dkd7
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@5.16.6
1
url pkg:maven/org.apache.activemq/apache-activemq@5.17.4
purl pkg:maven/org.apache.activemq/apache-activemq@5.17.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3a83-kwkc-13dq
1
vulnerability VCID-92hs-e8rr-yke5
2
vulnerability VCID-nv1w-jgty-yyfk
3
vulnerability VCID-umda-53ec-dkd7
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@5.17.4
aliases CVE-2022-41678, GHSA-53v4-42fg-g287
risk_score 10.0
exploitability 2.0
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xuvk-6evd-hqht
Fixing_vulnerabilities
Risk_score10.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.activemq/apache-activemq@5.12.3