SB20260824108 - openEuler 24.03 LTS SP4 update for activemq

Description

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-59878)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the AMQP NIO connector when processing a crafted frame size value. A remote attacker can send a specially crafted frame to cause a denial of service.

If triggered rapidly enough, the issue can exhaust the NIO thread pool and deny service to other connections.

2) Improper Authorization (CVE-ID: CVE-2026-61487)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authorization and publish messages to unauthorized destinations.

The vulnerability exists due to improper authorization in ActiveMQ destination authorization handling when sending to a temporary composite destination whose physical name is a comma-separated composite of real queues. A remote user can send a message to a crafted temporary composite destination to bypass authorization and publish messages to unauthorized destinations.

The issue affects per-destination write ACL enforcement for temporary composite destinations.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3267