[
https://issues.apache.org/jira/browse/TOMEE-4721?focusedWorklogId=1045082&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1045082
]
ASF GitHub Bot logged work on TOMEE-4721:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 01/Oct/26 08:07
Start Date: 01/Oct/26 08:07
Worklog Time Spent: 10m
Work Description: rzo1 opened a new pull request, #3011:
URL: https://github.com/apache/tomee/pull/3011
Bumps `version.activemq` from 6.2.10 to 6.3.2 on tomee-10.x to fix
[CVE-2026-74761](https://nvd.nist.gov/vuln/detail/CVE-2026-74761). The CVE
affects all 6.x releases before 6.3.2, and there is no fixed 6.2.x release.
6.3 is normally the TomEE 11 line. For the ActiveMQ modules TomEE 10 ships
(broker, client, jdbc-store, openwire-legacy, ra), the runtime spec
dependencies are unchanged from 6.2.10: Jakarta Messaging 3.1, Connector, and
Annotation, all provided by TomEE at EE 10 levels. Both lines target Java 17.
The EE 11 dependencies in 6.3 (Servlet 6.1, EL 6.0, Jetty 12, Spring 7) belong
to the web console and HTTP transport, which TomEE does not ship.
CI only compiles this change, so the JMS tests and the arquillian JMS tests
are where any runtime regression would show up.
https://issues.apache.org/jira/browse/TOMEE-4721
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1045082)
Remaining Estimate: 0h
Time Spent: 10m
> ActiveMQ 6.3.2
> --------------
>
> Key: TOMEE-4721
> URL: https://issues.apache.org/jira/browse/TOMEE-4721
> Project: TomEE
> Issue Type: Dependency upgrade
> Components: TomEE Core Server
> Affects Versions: 10.2.0
> Reporter: RAJU THANNEERU
> Priority: Major
> Fix For: 10.3.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> |[CVE-2026-74761|https://nvd.nist.gov/vuln/detail/CVE-2026-74761]|7.5|high|fixed
> in 6.3.2, 5.19.11|2026-09-18 20:38:56 +0000
> UTC|[org.apache.activemq_activemq-client_6.2.9|https://otscan.otxlab.net/api/v1/scan/727397e4-a382-4365-aa52-4e70e53920d4/report/html#sha256:f9178e02d199d38ba1d1d83dfa82d6f45b28748f50c62139038291f22639b3a5_org.apache.activemq_activemq-client_6.2.9]|this
> image|/usr/local/tomee/lib/activemq-client-6.2.9.jar|
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
