This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/activemq-website.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 1e39d6f72 Automatic Site Publish by Buildbot
1e39d6f72 is described below
commit 1e39d6f7278efe43e7b7e9b7ebde09ef274f0279
Author: buildbot <[email protected]>
AuthorDate: Mon Jul 27 17:24:23 2026 +0000
Automatic Site Publish by Buildbot
---
output/components/classic/security.html | 2 ++
.../CVE-2026-59878-announcement.txt | 28 ++++++++++++++++++++
.../CVE-2026-61487-announcement.txt | 30 ++++++++++++++++++++++
3 files changed, 60 insertions(+)
diff --git a/output/components/classic/security.html
b/output/components/classic/security.html
index 796511f60..62e157166 100644
--- a/output/components/classic/security.html
+++ b/output/components/classic/security.html
@@ -97,6 +97,8 @@
<p>See the main <a href="../../security-advisories">Security Advisories</a>
page for details for other components and general information such as reporting
new security issues.</p>
<ul>
+ <li><a
href="../../security-advisories.data/CVE-2026-61487-announcement.txt">CVE-2026-61487</a>
- Authorization bypass via temporary composite destinations</li>
+ <li><a
href="../../security-advisories.data/CVE-2026-59878-announcement.txt">CVE-2026-59878</a>
- AMQP NIO negative frame size validation bypass leading to DoS</li>
<li><a
href="../../security-advisories.data/CVE-2026-54475-announcement.txt">CVE-2026-54475</a>
- Temporary destination ownership takeover</li>
<li><a
href="../../security-advisories.data/CVE-2026-53917-announcement.txt">CVE-2026-53917</a>
- Unbounded memory allocation in OpenWire property unmarshalling</li>
<li><a
href="../../security-advisories.data/CVE-2026-49157-announcement.txt">CVE-2026-53916</a>
- Unbounded header buffer in STOMP NIO codec</li>
diff --git a/output/security-advisories.data/CVE-2026-59878-announcement.txt
b/output/security-advisories.data/CVE-2026-59878-announcement.txt
new file mode 100644
index 000000000..1f826eeec
--- /dev/null
+++ b/output/security-advisories.data/CVE-2026-59878-announcement.txt
@@ -0,0 +1,28 @@
+Severity: moderate
+
+Affected versions:
+
+- Apache ActiveMQ AMQP (org.apache.activemq:activemq-amqp) before 5.19.9
+- Apache ActiveMQ AMQP (org.apache.activemq:activemq-amqp) 6.0.0 before 6.2.8
+- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.9
+- Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.8
+- Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.9
+- Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.8
+
+Description:
+
+Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache
ActiveMQ, Apache ActiveMQ All.
+
+A remote unauthenticated peer that can reach an exposed AMQP NIO connector can
trigger denial-of-service behavior by sending a frame size value. This cause
the NIO threads to die and if done rapidly enough can lead to exhaustion of the
NIO thread pool denying service to other connections.
+This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before
6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ
All: before 5.19.9, from 6.0.0 before 6.2.8.
+
+Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which
fixes the issue.
+
+Credit:
+
+zx (Jace) (finder)
+
+References:
+
+https://activemq.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-59878
diff --git a/output/security-advisories.data/CVE-2026-61487-announcement.txt
b/output/security-advisories.data/CVE-2026-61487-announcement.txt
new file mode 100644
index 000000000..3029c0578
--- /dev/null
+++ b/output/security-advisories.data/CVE-2026-61487-announcement.txt
@@ -0,0 +1,30 @@
+Severity: important
+
+Affected versions:
+
+- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.9
+- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before
6.2.8
+- Apache ActiveMQ All (org.apache.activemq:activemq-all) before 5.19.9
+- Apache ActiveMQ All (org.apache.activemq:activemq-all) 6.0.0 before 6.2.8
+- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.9
+- Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.8
+
+Description:
+
+Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache
ActiveMQ All, Apache ActiveMQ.
+
+ An authenticated low-privilege user can bypass a per-destination
+write ACL by sending to an ActiveMQ temporary composite destination whose
physical name is a
+comma-separated composite of real queues. This allows publishing messages to
any of the destinations in the list without proper write ACL permissions
because the authorization check is bypassed due to the composite destination
being marked as temporary.
+This issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before
6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache
ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8.
+
+Users are recommended to upgrade to version 5.19.9, 6.2.8 or 6.3.0, which
fixes the issue.
+
+Credit:
+
+Claude and Ada Logics (finder)
+
+References:
+
+https://activemq.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-61487
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
For further information, visit: https://activemq.apache.org/contact
