VulnerableCode Package Details - pkg:maven/org.apache.activemq/activemq-broker@6.0.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-ckcj-176v-6fcy Aliases: CVE-2026-34197 GHSA-rxpj-7qvf-xv32		6.2.3 Affected by 0 other vulnerabilities.
VCID-cm77-qbk4-63ff Aliases: CVE-2026-39304 GHSA-5568-6qcg-g7fx	Apache ActiveMQ: Denial of Service via Out of Memory vulnerability Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS. Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.	6.2.4 Affected by 0 other vulnerabilities.
VCID-qpr5-vxte-dqea Aliases: CVE-2026-33227 GHSA-h2h4-5m64-m273		6.2.2 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-ckcj-176v-6fcy
Aliases:
CVE-2026-34197
GHSA-rxpj-7qvf-xv32

6.2.3
Affected by 0 other vulnerabilities.

VCID-cm77-qbk4-63ff
Aliases:
CVE-2026-39304
GHSA-5568-6qcg-g7fx

Apache ActiveMQ: Denial of Service via Out of Memory vulnerability Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS. Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.

6.2.4
Affected by 0 other vulnerabilities.

VCID-qpr5-vxte-dqea
Aliases:
CVE-2026-33227
GHSA-h2h4-5m64-m273

6.2.2
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-19T00:06:22.640135+00:00	GHSA Importer	Affected by	VCID-ckcj-176v-6fcy	https://github.com/advisories/GHSA-rxpj-7qvf-xv32	38.4.0
2026-04-14T02:42:41.084721+00:00	GHSA Importer	Affected by	VCID-ckcj-176v-6fcy	https://github.com/advisories/GHSA-rxpj-7qvf-xv32	38.3.0
2026-04-13T07:05:09.557064+00:00	GHSA Importer	Affected by	VCID-cm77-qbk4-63ff	https://github.com/advisories/GHSA-5568-6qcg-g7fx	38.3.0
2026-04-08T19:02:28.109356+00:00	GHSA Importer	Affected by	VCID-qpr5-vxte-dqea	https://github.com/advisories/GHSA-h2h4-5m64-m273	38.1.0