Hi,

The following vulnerabilities were published for activemq.

CVE-2026-111821[0]:
| Improper input validation vulnerability in Apache ActiveMQ, Apache
| ActiveMQ KahaDB.    A user can create a durable subscription with a
| clientId and subscription name that have a combined length > 65,535
| (while separately being shorter) on a broker using KahaDB which can
| cause the broker to shutdown and be unrecoverable.     This issue
| affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12;
| Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
| Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12,
| which fixes the issue.

https://lists.apache.org/thread/p8gxq66lmztkrls74wkz3xh9chqd0pwl

CVE-2026-111822[1]:
| Improper invalidation of cached authorizations vulnerability in
| Apache ActiveMQ, Apache ActiveMQ Runtime Config.    After the
| runtime configuration plugin removes a principal's write grant on a
| destination, an authenticated connection opened before the change
| can keep sending to that destination, including through a new
| anonymous producer, while fresh connections and new explicit
| producers are denied.    This issue affects Apache ActiveMQ: from
| 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config:
| from 6.0.0 before 6.3.3, before 5.19.12.    Users are recommended to
| upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

https://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5

CVE-2026-108500[2]:
| Input validation vulnerability in Apache ActiveMQ configured to use
| the LDAPAuthorizationMapPlugin allows an authenticated attacker
| to create or address a destination with a crafted name containing
| LDAP DN special characters (such as comma, plus, equals, backslash)
| can manipulate the LDAP search base used for ACL lookups.    This
| issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0
| before 5.19.12.    Users are recommended to upgrade to version
| 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

https://lists.apache.org/thread/0oh4k4ty6hv56d4sydjp26l95f4bsnxt

CVE-2026-108946[3]:
| Improper input validation vulnerability in Apache ActiveMQ, Apache
| ActiveMQ KahaDB.    The ActiveMQ broker resolves connection, session
| and consumer state from ids that are user provided and in some
| scenarios does not validate that they ids are bound to that user.
| This allows an authenticated client to spoof another user's ids.
| This allows:        *   an authenticated client consumes from
| another connection's temporary queue/topic by putting the victim's
| connection id in its own ConsumerId, bypassing the broker-side
| ownership check.    *  a duplicate ConsumerId registration is only
| logged, after which the attacker's RemoveInfo or disconnect tears
| down the victim's live subscription   *  a forged MessageAck for the
| victim's ConsumerId permanently deletes an in-flight, unacknowledged
| message.         This issue affects Apache ActiveMQ: from 6.0.0
| before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0
| before 6.3.3, before 5.19.12.    Users are recommended to upgrade to
| version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.

https://lists.apache.org/thread/0spj0m846vhw3cjyfmzsy3l8vxh6f5t6

CVE-2026-108949[4]:
| Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ
| Broker.    An authenticated OpenWire client that sends a
| ConsumerInfo for a temporary queue/topic owned by another connection
| is rejected with InvalidDestinationException, but the rejected
| Subscription is left behind in the region's subscriptions map.
| Repeating the request leaks broker heap until OOM because the broker
| does not clean up the rejected subscriptions in the map.    This
| issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before
| 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12.
| Users are recommended to upgrade to version 6.4.0, 6.3.3, or
| 5.19.12, which fixes the issue.

https://lists.apache.org/thread/2l1jbc8j88w1n9bd44vm9bjtj9t3o80n


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111821
https://www.cve.org/CVERecord?id=CVE-2026-111821
[1] https://security-tracker.debian.org/tracker/CVE-2026-111822
https://www.cve.org/CVERecord?id=CVE-2026-111822
[2] https://security-tracker.debian.org/tracker/CVE-2026-108500
https://www.cve.org/CVERecord?id=CVE-2026-108500
[3] https://security-tracker.debian.org/tracker/CVE-2026-108946
https://www.cve.org/CVERecord?id=CVE-2026-108946
[4] https://security-tracker.debian.org/tracker/CVE-2026-108949
https://www.cve.org/CVERecord?id=CVE-2026-108949

Please adjust the affected versions in the BTS as needed.