[
https://issues.apache.org/jira/browse/TOMEE-4721?focusedWorklogId=1045083&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1045083
]
ASF GitHub Bot logged work on TOMEE-4721:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 01/Oct/26 08:08
Start Date: 01/Oct/26 08:08
Worklog Time Spent: 10m
Work Description: rzo1 commented on PR #3011:
URL: https://github.com/apache/tomee/pull/3011#issuecomment-5927413675
@jungm heads-up, since this moves tomee-10.x off the 6.2.x line we normally
keep it on: in this case, moving to 6.3.2 is fine.
**Why we can't stay on 6.2.x:** CVE-2026-74761 affects every 6.x release
before 6.3.2, and no fixed 6.2.x exists. 6.2.10 is the latest 6.2 release on
Central.
- Advisory: https://activemq.apache.org/components/classic/security
- NVD ranges: https://nvd.nist.gov/vuln/detail/CVE-2026-74761 (`from 6.0.0
before 6.3.2`, `before 5.19.11`)
- Released versions:
https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-client/maven-metadata.xml
**Why 6.3.2 stays EE 10 compatible for what we ship:**
- The ActiveMQ parent POMs
([6.2.10](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-parent/6.2.10/activemq-parent-6.2.10.pom),
[6.3.2](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-parent/6.3.2/activemq-parent-6.3.2.pom))
declare the same `jakarta-jms-api-version` 3.1.0 and `javaVersion` 17. Jakarta
Messaging 3.1 is in both EE 10 and EE 11.
- TomEE 10 ships five ActiveMQ modules. Their non-test Jakarta, Spring and
Jetty dependencies are the same in both versions:
| Module | Dependency (6.2.10 and 6.3.2) | POMs |
|---|---|---|
| activemq-client | `jakarta.jms-api` |
[6.2.10](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-client/6.2.10/activemq-client-6.2.10.pom)
/
[6.3.2](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-client/6.3.2/activemq-client-6.3.2.pom)
|
| activemq-broker | `jakarta.annotation-api` |
[6.2.10](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-broker/6.2.10/activemq-broker-6.2.10.pom)
/
[6.3.2](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-broker/6.3.2/activemq-broker-6.3.2.pom)
|
| activemq-ra | `jakarta.resource-api` |
[6.2.10](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-ra/6.2.10/activemq-ra-6.2.10.pom)
/
[6.3.2](https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-ra/6.3.2/activemq-ra-6.3.2.pom)
|
| activemq-jdbc-store, activemq-openwire-legacy | none | |
TomEE provides those API jars itself at EE 10 levels, so ActiveMQ's
managed API versions never reach the distribution.
- The EE 11-level dependencies in 6.3 are Servlet 6.1, EL 6.0, JSP 4.0,
Jetty 12 and Spring 7. They come only from the web console and the HTTP
transport, and TomEE 10 ships neither.
As usual, CI only compiles this. A runtime regression would show up in the
JMS and Arquillian JMS tests, not in the PR check.
Issue Time Tracking
-------------------
Worklog Id: (was: 1045083)
Time Spent: 20m (was: 10m)
> ActiveMQ 6.3.2
> --------------
>
> Key: TOMEE-4721
> URL: https://issues.apache.org/jira/browse/TOMEE-4721
> Project: TomEE
> Issue Type: Dependency upgrade
> Components: TomEE Core Server
> Affects Versions: 10.2.0
> Reporter: RAJU THANNEERU
> Priority: Major
> Fix For: 10.3.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> |[CVE-2026-74761|https://nvd.nist.gov/vuln/detail/CVE-2026-74761]|7.5|high|fixed
> in 6.3.2, 5.19.11|2026-09-18 20:38:56 +0000
> UTC|[org.apache.activemq_activemq-client_6.2.9|https://otscan.otxlab.net/api/v1/scan/727397e4-a382-4365-aa52-4e70e53920d4/report/html#sha256:f9178e02d199d38ba1d1d83dfa82d6f45b28748f50c62139038291f22639b3a5_org.apache.activemq_activemq-client_6.2.9]|this
> image|/usr/local/tomee/lib/activemq-client-6.2.9.jar|
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
