Skip to content

ActiveMQ

Streaming & Message Queues

A high‑performance Apache‑licensed message broker that supports JMS, AMQP, MQTT and HTTP protocols

Track releases GitHub Website
Java Latest activemq-5.19.8 · 1mo ago Security brief →

Features

  • Supports Jakarta Messaging (JMS) 3.1/2.0/1.1
  • Provides AMQP and MQTT protocol connectors
  • Offers HTTP/WebSocket transport
  • Advanced features: network of brokers, message scheduling

Security Response History

8 CVEs
CVE Severity Disclosed Patched (this tool) vs Ecosystem Median
CVE-2026-34197 KEV high
CVSS 8.8
 2026-04-07 2026-04-08 30h
CVE-2023-46604 KEV critical
CVSS 10.0
 2023-11-02 2026-03-20 2y 5mo / median 2y 5mo
CVE-2021-45046 KEV critical
CVSS 9.0
 2023-05-01 2026-03-20 2y 11mo / median 2y 9mo
CVE-2021-39144 KEV high
CVSS 8.5
 2023-03-10 2026-03-20 3y / median 2y 10mo
CVE-2022-22965 KEV critical
CVSS 9.8
 2022-04-04 2026-03-20 4y / median 3y 10mo
CVE-2016-3088 KEV critical
CVSS 9.8
 2022-02-10 2026-03-20 4y 1mo / median 4y 1mo
CVE-2021-44228 KEV critical
CVSS 10.0
 2021-12-10 2026-03-20 4y 3mo / median 4y 2mo
CVE-2016-4437 KEV critical
CVSS 9.8
 2021-11-03 2026-03-20 4y 5mo / median 4y 5mo

Recent releases

View all 12 releases →
Review required
activemq-5.19.8 Security relevant
Auth RBAC

Security hardening

Open
Review required
activemq-6.2.7 Security relevant
Auth RBAC

Advisory security updates

Open
Upgrade now
activemq-5.19.7 Breaking risk
Dependencies

Remove java.lang serialization

Open
Review required
activemq-6.2.6 Breaking risk
Auth RBAC RCE / SSRF

Serializable package removal + hardened access

patches CVE-2016-3088 patches CVE-2016-4437 patches CVE-2021-39144 +5 more
Open
activemq-5.19.6 Security relevant
Security fixes
  • XBeanBrokerFactory URL protocol type restrictions
  • Remote file filtering for XBeanBrokerFactory
Full changelog

What's Changed

  • Bump to 5.19.6-SNAPSHOT version by @jbonofre in https://github.com/apache/activemq/pull/1893
  • [5.19.x] SSL handshake write timeout enforcement (#1883) by @cshannon in https://github.com/apache/activemq/pull/1896
  • [5.19.x] Minor bug fix for BrokerView#validateAllowedUri (#1900) by @cshannon in https://github.com/apache/activemq/pull/1903
  • [5.19.x] Restrict URL protocol types loaded by XBeanBrokerFactory (#1910) by @cshannon in https://github.com/apache/activemq/pull/1916
  • [5.19.x] Make brokerName immutable in RegionBroker (#1917) by @cshannon in https://github.com/apache/activemq/pull/1924
  • [5.19.x] Add Http discovery transport to denied list for JMX (#1918) by @cshannon in https://github.com/apache/activemq/pull/1926
  • [5.19.x] Update resource cleanup on queueBrowse servlet (#1912) by @cshannon in https://github.com/apache/activemq/pull/1927
  • [5.19.x] Update DestinationView uri resolution (#1914) by @cshannon in https://github.com/apache/activemq/pull/1929
  • fix(webconsole): the webconsole now redirect to the slave.jsp when required [5.19.x] by @jbonofre in https://github.com/apache/activemq/pull/1936
  • [5.19.x] Queue browse improvements in webconsole (#1938) by @cshannon in https://github.com/apache/activemq/pull/1943
  • [5.19.x] Add more transport types to the denied list for JMX (#1949) by @cshannon in https://github.com/apache/activemq/pull/1953
  • [5.19.x] Add remote file filtering for XBeanBrokerFactory (#1950) by @cshannon in https://github.com/apache/activemq/pull/1955

Full Changelog: https://github.com/apache/activemq/compare/activemq-5.19.5...activemq-5.19.6

View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
2,442
Forks
1,489
Languages
Java JavaScript HTML
View on GitHub Homepage Documentation

Install & Platforms

Install via
binary docker

Similar tools

UQLM
Apache Maven

Beta — feedback welcome: [email protected]