CVE-2026-33227: Apache ActiveMQ Classpath Path Name Validation Vulnerability
Summary
CVE-2026-33227: Apache ActiveMQ: Improper validation and restriction of a classpath path name. Affects org.apache.activemq:activemq-client across 2 version ranges.
< 5.19.3
>= 6.0.0, < 6.2.2
Fixed in 5.19.3 or 6.2.2, depending on the release line you run. How to fix ↓
Also tracked for
- activemq · Bitnami
The same CVE-2026-33227 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is a popular open-source messaging server that facilitates communication between applications through message queues. It supports various messaging protocols, including Stomp, and is widely used for its reliability and scalability. However, a recent vulnerability has been identified that affects its ability to properly validate classpath path names, potentially exposing applications to security risks.
Vulnerability Detail
The vulnerability arises from improper validation and restriction of classpath path names in Apache ActiveMQ Client, Broker, and All versions. Specifically, when creating a Stomp consumer or browsing messages in the Web console, an authenticated user can manipulate the 'key' value to traverse the classpath due to path concatenation. This flaw can lead to unauthorized resource loading, which may be exploited in conjunction with other attacks, posing a significant security risk.
How To Fix
Latest published version: 6.3.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.19.35.19.3 -
>= 6.0.0, < 6.2.26.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users should restrict access to the Stomp consumer and Web console functionalities until the upgrade can be applied. Additionally, ensure that only trusted users have access to the application to mitigate potential exploitation.
Conclusion
The CVE-2026-33227 vulnerability in Apache ActiveMQ poses a significant risk due to improper validation of classpath path names. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for org.apache.activemq:activemq-client →
FAQ
CVE-2026-33227 is a vulnerability in Apache ActiveMQ that allows an authenticated user to manipulate classpath path names, potentially leading to unauthorized resource loading.
The vulnerability affects Apache ActiveMQ Client, Broker, and All versions prior to 5.19.4 and 6.2.3.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your pom.xml file on the Vulert playground, you can determine if your application is affected.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
If immediate upgrading is not possible, restrict access to vulnerable functionalities and ensure that only trusted users can access the application.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-client.
