Bug#1153259: activemq: CVE-2026-108500 CVE-2026-108946 CVE-2026-108949

[Moritz Mühlenhoff]

Source: activemq
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for activemq.

CVE-2026-108500[0]:
| Input validation vulnerability in Apache ActiveMQ configured to use
| the LDAPAuthorizationMapPlugin allows an authenticated attacker
| to create or address a destination with a crafted name containing
| LDAP DN special characters (such as comma, plus, equals, backslash)
| can manipulate the LDAP search base used for ACL lookups.    This
| issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0
| before 5.19.12.    Users are recommended to upgrade to version
| 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

https://lists.apache.org/thread/0oh4k4ty6hv56d4sydjp26l95f4bsnxt

CVE-2026-108946[1]:
| Improper input validation vulnerability in Apache ActiveMQ, Apache
| ActiveMQ KahaDB.    The ActiveMQ broker resolves connection, session
| and consumer state from ids that are user provided and in some
| scenarios does not validate that they ids are bound to that user.
| This allows an authenticated client to spoof another user's ids.
| This allows:        *   an authenticated client consumes from
| another connection's temporary queue/topic by putting the victim's
| connection id in its own ConsumerId, bypassing the broker-side
| ownership check.    *  a duplicate ConsumerId registration is only
| logged, after which the attacker's RemoveInfo or disconnect tears
| down the victim's live subscription   *  a forged MessageAck for the
| victim's ConsumerId permanently deletes an in-flight, unacknowledged
| message.         This issue affects Apache ActiveMQ: from 6.0.0
| before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0
| before 6.3.3, before 5.19.12.    Users are recommended to upgrade to
| version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.

https://lists.apache.org/thread/0spj0m846vhw3cjyfmzsy3l8vxh6f5t6

CVE-2026-108949[2]:
| Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ
| Broker.    An authenticated OpenWire client that sends a
| ConsumerInfo for a temporary queue/topic owned by another connection
| is rejected with InvalidDestinationException, but the rejected
| Subscription is left behind in the region's subscriptions map.
| Repeating the request leaks broker heap until OOM because the broker
| does not clean up the rejected subscriptions in the map.    This
| issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before
| 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12.
| Users are recommended to upgrade to version 6.4.0, 6.3.3, or
| 5.19.12, which fixes the issue.

https://lists.apache.org/thread/2l1jbc8j88w1n9bd44vm9bjtj9t3o80n


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-108500
    https://www.cve.org/CVERecord?id=CVE-2026-108500
[1] https://security-tracker.debian.org/tracker/CVE-2026-108946
    https://www.cve.org/CVERecord?id=CVE-2026-108946
[2] https://security-tracker.debian.org/tracker/CVE-2026-108949
    https://www.cve.org/CVERecord?id=CVE-2026-108949

Please adjust the affected versions in the BTS as needed.