---
id: "CVE-2026-49434"
kind: "vulnerability"
aliases: ["CVE-2026-49434", "GHSA-h5gm-rvw6-2xpx"]
title: "Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability"
severity: "high"
cvss: 7.5
epss: 0.0063
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.activemq:activemq-broker", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "maven"}, {"name": "org.apache.activemq:activemq-broker", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "maven"}, {"name": "org.apache.activemq:apache-activemq", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "maven"}, {"name": "org.apache.activemq:apache-activemq", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "maven"}, {"name": "org.apache.activemq:activemq-all", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "maven"}, {"name": "org.apache.activemq:activemq-all", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "maven"}, {"name": "apache activemq", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "vendor"}, {"name": "apache activemq", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "vendor"}, {"name": "apache activemq broker", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "vendor"}, {"name": "apache activemq broker", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["apache-activemq", "cwe-20", "java", "ldap", "messaging", "package"]
not_affected_if: ["fixed-version", "no-ldap"]
published_at: "2026-06-30T11:16:29+00:00"
first_seen_at: "2026-11-04T15:32:56+00:00"
updated_at: "2026-11-04T15:57:43+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h5gm-rvw6-2xpx", "first_seen_at": "2026-11-04T15:32:56+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49434", "first_seen_at": "2026-11-04T15:57:43+00:00"}]
---

# Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability

Apache ActiveMQ lets an attacker who can publish or modify entries in the LDAP directory used by the broker instantiate denied transports inside the broker JVM. This can make the broker fetch an attacker-controlled URL and start a second BrokerService in the same process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.activemq:activemq-broker affected < 5.19.8 fixed 5.19.8
- maven:org.apache.activemq:activemq-broker affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- maven:org.apache.activemq:apache-activemq affected < 5.19.8 fixed 5.19.8
- maven:org.apache.activemq:apache-activemq affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- maven:org.apache.activemq:activemq-all affected < 5.19.8 fixed 5.19.8
- maven:org.apache.activemq:activemq-all affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- vendor:apache activemq affected < 5.19.8 fixed 5.19.8
- vendor:apache activemq affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- vendor:apache activemq broker affected < 5.19.8 fixed 5.19.8
- vendor:apache activemq broker affected >= 6.0.0, < 6.2.7 fixed 6.2.7

## How to check

- Check the ActiveMQ version in the broker's Maven dependencies or installed distribution, for example `activemq-broker`, `apache-activemq` or `activemq-all`.
- Look for LDAP-based authorization or authentication settings (searchBase and searchFilter) in the broker configuration.

## Fix

- Upgrade `activemq-broker`, `apache-activemq` and `activemq-all` 5.x to `5.19.8`.
- Upgrade these artifacts 6.x to `6.2.7`.

## Timeline

- 2026-11-04T15:32:56+00:00 ghsa https://github.com/advisories/GHSA-h5gm-rvw6-2xpx
- 2026-11-04T15:57:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49434

## Documents

- [advisory] Vendor advisory: lists.apache.org https://lists.apache.org/thread/hcjh7kdk4l85tb9ksmvcnkhso1ngj50o
- [advisory] Third-party advisory: www.openwall.com http://www.openwall.com/lists/oss-security/2026/06/29/8
- [fix] Patch: github.com https://github.com/apache/activemq/commit/ac3d06454bdf8b21db7ef419f42d17ab124a6008
- [fix] Patch: github.com https://github.com/apache/activemq/commit/f055bcc1dcd4a4a76b731fef43829fff515a7fbf
- [fix] Patch: github.com https://github.com/apache/activemq/pull/2077
- [fix] Release: github.com https://github.com/apache/activemq/releases/tag/activemq-6.2.7
- [fix] Release: github.com https://github.com/apache/activemq/releases/tag/activemq-5.19.8
- [fix] Patch: github.com https://github.com/apache/activemq/commit/0927bcb99e18c517728898be9f125589653ee899

## From the sources

Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM.
This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.


Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_