SB2026070970 - openEuler 24.03 LTS SP1 update for activemq
Published: July 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-49432)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the STOMP connector when processing STOMP frames with a negative content-length. A remote attacker can send a specially crafted STOMP frame to cause a denial of service.
For the NIO STOMP transport, exploitation can grow the per-connection command buffer beyond configured limits and lead to out-of-memory conditions. For the blocking STOMP protocol, exploitation causes abnormal transport exception handling for the affected connection and its closure.
2) Input validation error (CVE-ID: CVE-2026-49434)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to instantiate denied transports inside the broker JVM and spawn a second BrokerService in the same JVM.
The vulnerability exists due to improper input validation in LdapNetworkConnector when processing LDAP entries that match the configured searchBase and searchFilter. A remote user can publish or modify matching LDAP entries to instantiate denied transports inside the broker JVM and spawn a second BrokerService in the same JVM.
Exploitation can be used to fetch an attacker-controlled URL.
3) Improper Authorization (CVE-ID: CVE-2026-49877)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access administrative functionality.
The vulnerability exists due to improper authorization in the Web Console /admin/* paths when handling requests from authenticated low-privilege Web Console users. A remote user can access /admin/* paths to access administrative functionality.
The issue is caused by default Jetty settings that do not restrict those paths to administrators only.
4) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-50734)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in OpenWire wire format negotiation when processing a WireFormatInfo frame during pre-authentication negotiation. A remote attacker can send a crafted WireFormatInfo frame with a malicious large size value to cause a denial of service.
The issue can trigger out-of-memory conditions and crash the broker.
5) Cross-site scripting (CVE-ID: CVE-2026-52760)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script in an administrator's browser.
The vulnerability exists due to cross-site scripting in the browse page of the ActiveMQ Web Console when rendering a JMS message ID without sanitization. A remote user can send a crafted message with a malicious JMS message ID to execute arbitrary script in an administrator's browser.
User interaction is required when an administrator browses the queue in the Web Console.
6) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-53916)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in the STOMP NIO codec when handling header bytes on a STOMP NIO connection. A remote attacker can send header bytes that never terminate to cause a denial of service.
The issue can exhaust the JVM heap.
7) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-53917)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in OpenWire message property map unmarshalling when processing a crafted OpenWire message with a large encoded map size value. A remote user can send a specially crafted OpenWire message to cause a denial of service.
The issue can trigger out-of-memory conditions and crash the broker.
Remediation
Install update from vendor's website.