{"schemaVersion":3,"id":"CVE-2026-49434","aliases":["UBUNTU-CVE-2026-49434","DEBIAN-CVE-2026-49434"],"status":"published","duplicateOf":null,"title":null,"description":"Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nAn attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM.\nThis issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.\n\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.","dates":{"published":"2026-06-30T09:55:29.533Z","modified":"2026-06-30T12:27:49.847Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0063,"percentile":0.49163,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.0063},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0063,"percentile":0.49163}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0063,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0063,"percentile":0.49163}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"apache software foundation","product":"apache activemq","name":"Apache ActiveMQ","label":"apache activemq","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.19.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, < 6.2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.19.8 | ≥ 6.0.0, < 6.2.7","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_activemq"},{"vendor":"apache software foundation","product":"apache activemq all","name":"Apache ActiveMQ All","label":"apache activemq all","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.19.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, < 6.2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.19.8 | ≥ 6.0.0, < 6.2.7","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_activemq_all"},{"vendor":"apache software foundation","product":"apache activemq broker","name":"Apache ActiveMQ Broker","label":"apache activemq broker","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.19.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, < 6.2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.19.8 | ≥ 6.0.0, < 6.2.7","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_activemq_broker"},{"vendor":"apache","product":"activemq","name":"ActiveMQ","label":"activemq","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.19.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, < 6.2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.19.8 | ≥ 6.0.0, < 6.2.7","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"apache-activemq","label":"Apache ActiveMQ Classic","category":"server-app"}},"hubHref":"/vendor/apache/activemq"},{"vendor":"apache","product":"activemq_broker","name":"activemq broker","label":"activemq_broker","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.19.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, < 6.2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.19.8 | ≥ 6.0.0, < 6.2.7","eol":null,"hubHref":"/vendor/apache/activemq_broker"},{"vendor":"debian","product":"activemq","name":"activemq","label":"activemq","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/activemq","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"activemq","name":"activemq","label":"activemq","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/activemq","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.apache.org/thread/hcjh7kdk4l85tb9ksmvcnkhso1ngj50o","label":"lists.apache.org/thread/hcjh7kdk4l85tb9ksmvcnkhso1ngj50o","hostname":"lists.apache.org","tags":["Vendor Advisory","REPORT"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/29/8","label":"www.openwall.com/lists/oss-security/2026/06/29/8","hostname":"www.openwall.com","tags":["Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-49434","label":"ubuntu.com/security/CVE-2026-49434","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49434","label":"www.cve.org/CVERecord?id=CVE-2026-49434","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-49434","label":"security-tracker.debian.org/tracker/CVE-2026-49434","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-06-30T09:55:29.533Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-30T12:27:49.847Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:41:04.982Z","stale":false,"partial":false}}