CVE-2026-49362
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Scoring
- CVSS base score
- 0
- CWE
- CWE-306
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- Apache Software Foundation Apache Artemis
- Apache Software Foundation Apache ActiveMQ Artemis
Weakness type
Related vulnerabilities
- CVE-2026-49363 — Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
- CVE-2026-49364 — Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
- CVE-2026-57967 — Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
- CVE-2026-67593 — Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
- CVE-2026-87924 — Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication
- CVE-2026-87922 — Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication
- CVE-2026-77974 — Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical function
- CVE-2026-79961 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...