VulnerableCode Package Details - pkg:maven/org.apache.activemq/activemq-client@6.0.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-cm77-qbk4-63ff Aliases: CVE-2026-39304 GHSA-5568-6qcg-g7fx	Apache ActiveMQ: Denial of Service via Out of Memory vulnerability Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS. Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.	6.2.4 Affected by 0 other vulnerabilities.
VCID-q6zs-spcv-v7ey Aliases: CVE-2025-27533 GHSA-whxr-3p84-rf3c	Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers.	6.1.6 Affected by 0 other vulnerabilities.
VCID-qpr5-vxte-dqea Aliases: CVE-2026-33227 GHSA-h2h4-5m64-m273		6.2.2 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-cm77-qbk4-63ff
Aliases:
CVE-2026-39304
GHSA-5568-6qcg-g7fx

Apache ActiveMQ: Denial of Service via Out of Memory vulnerability Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS. Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.

6.2.4
Affected by 0 other vulnerabilities.

VCID-q6zs-spcv-v7ey
Aliases:
CVE-2025-27533
GHSA-whxr-3p84-rf3c

Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers.

6.1.6
Affected by 0 other vulnerabilities.

VCID-qpr5-vxte-dqea
Aliases:
CVE-2026-33227
GHSA-h2h4-5m64-m273

6.2.2
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T23:28:26.048020+00:00	GitLab Importer	Affected by	VCID-q6zs-spcv-v7ey	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.activemq/activemq-client/CVE-2025-27533.yml	38.4.0
2026-04-13T07:05:09.525624+00:00	GHSA Importer	Affected by	VCID-cm77-qbk4-63ff	https://github.com/advisories/GHSA-5568-6qcg-g7fx	38.3.0
2026-04-12T00:48:02.229694+00:00	GitLab Importer	Affected by	VCID-q6zs-spcv-v7ey	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.activemq/activemq-client/CVE-2025-27533.yml	38.3.0
2026-04-08T19:02:28.014559+00:00	GHSA Importer	Affected by	VCID-qpr5-vxte-dqea	https://github.com/advisories/GHSA-h2h4-5m64-m273	38.1.0
2026-04-07T04:57:45.349394+00:00	GHSA Importer	Affected by	VCID-q6zs-spcv-v7ey	https://github.com/advisories/GHSA-whxr-3p84-rf3c	38.1.0
2026-04-03T00:56:02.260964+00:00	GitLab Importer	Affected by	VCID-q6zs-spcv-v7ey	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.activemq/activemq-client/CVE-2025-27533.yml	38.1.0
2026-04-02T12:41:23.146120+00:00	GitLab Importer	Affected by	VCID-q6zs-spcv-v7ey	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.activemq/activemq-client/CVE-2025-27533.yml	38.0.0