Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.

• https://activemq.apache.org/security-advisories.data/CVE-2026-33227-announcement.txt
• http://www.openwall.com/lists/oss-security/2026/04/06/4

• Apache » Activemq » Version: N/A
  cpe:2.3:a:apache:activemq:-
• Apache » Activemq » Version: 4.0
  cpe:2.3:a:apache:activemq:4.0
• Apache » Activemq » Version: 4.0.1
  cpe:2.3:a:apache:activemq:4.0.1
• Apache » Activemq » Version: 4.0.2
  cpe:2.3:a:apache:activemq:4.0.2
• Apache » Activemq » Version: 4.1.0
  cpe:2.3:a:apache:activemq:4.1.0
• Apache » Activemq » Version: 4.1.1
  cpe:2.3:a:apache:activemq:4.1.1
• Apache » Activemq » Version: 4.1.2
  cpe:2.3:a:apache:activemq:4.1.2
• Apache » Activemq » Version: 5.0.0
  cpe:2.3:a:apache:activemq:5.0.0
• Apache » Activemq » Version: 5.1.0
  cpe:2.3:a:apache:activemq:5.1.0
• Apache » Activemq » Version: 5.10.0
  cpe:2.3:a:apache:activemq:5.10.0
• Apache » Activemq » Version: 5.10.1
  cpe:2.3:a:apache:activemq:5.10.1
• Apache » Activemq » Version: 5.10.2
  cpe:2.3:a:apache:activemq:5.10.2
• Apache » Activemq » Version: 5.11.0
  cpe:2.3:a:apache:activemq:5.11.0
• Apache » Activemq » Version: 5.11.1
  cpe:2.3:a:apache:activemq:5.11.1
• Apache » Activemq » Version: 5.11.2
  cpe:2.3:a:apache:activemq:5.11.2
• Apache » Activemq » Version: 5.11.3
  cpe:2.3:a:apache:activemq:5.11.3
• Apache » Activemq » Version: 5.12.0
  cpe:2.3:a:apache:activemq:5.12.0
• Apache » Activemq » Version: 5.12.1
  cpe:2.3:a:apache:activemq:5.12.1
• Apache » Activemq » Version: 5.12.2
  cpe:2.3:a:apache:activemq:5.12.2
• Apache » Activemq » Version: 5.12.3
  cpe:2.3:a:apache:activemq:5.12.3
• Apache » Activemq » Version: 5.13.0
  cpe:2.3:a:apache:activemq:5.13.0
• Apache » Activemq » Version: 5.13.1
  cpe:2.3:a:apache:activemq:5.13.1
• Apache » Activemq » Version: 5.13.2
  cpe:2.3:a:apache:activemq:5.13.2
• Apache » Activemq » Version: 5.13.3
  cpe:2.3:a:apache:activemq:5.13.3
• Apache » Activemq » Version: 5.13.4
  cpe:2.3:a:apache:activemq:5.13.4
• Apache » Activemq » Version: 5.13.5
  cpe:2.3:a:apache:activemq:5.13.5
• Apache » Activemq » Version: 5.14.0
  cpe:2.3:a:apache:activemq:5.14.0
• Apache » Activemq » Version: 5.14.1
  cpe:2.3:a:apache:activemq:5.14.1
• Apache » Activemq » Version: 5.14.2
  cpe:2.3:a:apache:activemq:5.14.2
• Apache » Activemq » Version: 5.14.3
  cpe:2.3:a:apache:activemq:5.14.3
• Apache » Activemq » Version: 5.14.4
  cpe:2.3:a:apache:activemq:5.14.4
• Apache » Activemq » Version: 5.14.5
  cpe:2.3:a:apache:activemq:5.14.5
• Apache » Activemq » Version: 5.15.0
  cpe:2.3:a:apache:activemq:5.15.0
• Apache » Activemq » Version: 5.15.1
  cpe:2.3:a:apache:activemq:5.15.1
• Apache » Activemq » Version: 5.15.10
  cpe:2.3:a:apache:activemq:5.15.10
• Apache » Activemq » Version: 5.15.11
  cpe:2.3:a:apache:activemq:5.15.11
• Apache » Activemq » Version: 5.15.12
  cpe:2.3:a:apache:activemq:5.15.12
• Apache » Activemq » Version: 5.15.13
  cpe:2.3:a:apache:activemq:5.15.13
• Apache » Activemq » Version: 5.15.14
  cpe:2.3:a:apache:activemq:5.15.14
• Apache » Activemq » Version: 5.15.15
  cpe:2.3:a:apache:activemq:5.15.15
• Apache » Activemq » Version: 5.15.16
  cpe:2.3:a:apache:activemq:5.15.16
• Apache » Activemq » Version: 5.15.2
  cpe:2.3:a:apache:activemq:5.15.2
• Apache » Activemq » Version: 5.15.3
  cpe:2.3:a:apache:activemq:5.15.3
• Apache » Activemq » Version: 5.15.4
  cpe:2.3:a:apache:activemq:5.15.4
• Apache » Activemq » Version: 5.15.5
  cpe:2.3:a:apache:activemq:5.15.5
• Apache » Activemq » Version: 5.15.6
  cpe:2.3:a:apache:activemq:5.15.6
• Apache » Activemq » Version: 5.15.7
  cpe:2.3:a:apache:activemq:5.15.7
• Apache » Activemq » Version: 5.15.8
  cpe:2.3:a:apache:activemq:5.15.8
• Apache » Activemq » Version: 5.15.9
  cpe:2.3:a:apache:activemq:5.15.9
• Apache » Activemq » Version: 5.16.0
  cpe:2.3:a:apache:activemq:5.16.0
• Apache » Activemq » Version: 5.16.1
  cpe:2.3:a:apache:activemq:5.16.1
• Apache » Activemq » Version: 5.16.2
  cpe:2.3:a:apache:activemq:5.16.2
• Apache » Activemq » Version: 5.16.3
  cpe:2.3:a:apache:activemq:5.16.3
• Apache » Activemq » Version: 5.16.4
  cpe:2.3:a:apache:activemq:5.16.4
• Apache » Activemq » Version: 5.16.5
  cpe:2.3:a:apache:activemq:5.16.5
• Apache » Activemq » Version: 5.16.6
  cpe:2.3:a:apache:activemq:5.16.6
• Apache » Activemq » Version: 5.16.7
  cpe:2.3:a:apache:activemq:5.16.7
• Apache » Activemq » Version: 5.16.8
  cpe:2.3:a:apache:activemq:5.16.8
• Apache » Activemq » Version: 5.17.0
  cpe:2.3:a:apache:activemq:5.17.0
• Apache » Activemq » Version: 5.17.1
  cpe:2.3:a:apache:activemq:5.17.1
• Apache » Activemq » Version: 5.17.2
  cpe:2.3:a:apache:activemq:5.17.2
• Apache » Activemq » Version: 5.17.3
  cpe:2.3:a:apache:activemq:5.17.3
• Apache » Activemq » Version: 5.17.4
  cpe:2.3:a:apache:activemq:5.17.4
• Apache » Activemq » Version: 5.17.5
  cpe:2.3:a:apache:activemq:5.17.5
• Apache » Activemq » Version: 5.17.6
  cpe:2.3:a:apache:activemq:5.17.6
• Apache » Activemq » Version: 5.17.7
  cpe:2.3:a:apache:activemq:5.17.7
• Apache » Activemq » Version: 5.18.0
  cpe:2.3:a:apache:activemq:5.18.0
• Apache » Activemq » Version: 5.18.1
  cpe:2.3:a:apache:activemq:5.18.1
• Apache » Activemq » Version: 5.18.2
  cpe:2.3:a:apache:activemq:5.18.2
• Apache » Activemq » Version: 5.18.3
  cpe:2.3:a:apache:activemq:5.18.3
• Apache » Activemq » Version: 5.18.4
  cpe:2.3:a:apache:activemq:5.18.4
• Apache » Activemq » Version: 5.18.5
  cpe:2.3:a:apache:activemq:5.18.5
• Apache » Activemq » Version: 5.18.6
  cpe:2.3:a:apache:activemq:5.18.6
• Apache » Activemq » Version: 5.18.7
  cpe:2.3:a:apache:activemq:5.18.7
• Apache » Activemq » Version: 5.19.0
  cpe:2.3:a:apache:activemq:5.19.0
• Apache » Activemq » Version: 5.19.2
  cpe:2.3:a:apache:activemq:5.19.2
• Apache » Activemq » Version: 5.2.0
  cpe:2.3:a:apache:activemq:5.2.0
• Apache » Activemq » Version: 5.3.0
  cpe:2.3:a:apache:activemq:5.3.0
• Apache » Activemq » Version: 5.3.1
  cpe:2.3:a:apache:activemq:5.3.1
• Apache » Activemq » Version: 5.3.2
  cpe:2.3:a:apache:activemq:5.3.2
• Apache » Activemq » Version: 5.4.0
  cpe:2.3:a:apache:activemq:5.4.0
• Apache » Activemq » Version: 5.4.1
  cpe:2.3:a:apache:activemq:5.4.1
• Apache » Activemq » Version: 5.4.2
  cpe:2.3:a:apache:activemq:5.4.2
• Apache » Activemq » Version: 5.4.3
  cpe:2.3:a:apache:activemq:5.4.3
• Apache » Activemq » Version: 5.5.0
  cpe:2.3:a:apache:activemq:5.5.0
• Apache » Activemq » Version: 5.5.1
  cpe:2.3:a:apache:activemq:5.5.1
• Apache » Activemq » Version: 5.6.0
  cpe:2.3:a:apache:activemq:5.6.0
• Apache » Activemq » Version: 5.7.0
  cpe:2.3:a:apache:activemq:5.7.0
• Apache » Activemq » Version: 5.8.0
  cpe:2.3:a:apache:activemq:5.8.0
• Apache » Activemq » Version: 5.9.0
  cpe:2.3:a:apache:activemq:5.9.0
• Apache » Activemq » Version: 5.9.1
  cpe:2.3:a:apache:activemq:5.9.1
• Apache » Activemq » Version: 6.0.0
  cpe:2.3:a:apache:activemq:6.0.0
• Apache » Activemq » Version: 6.0.1
  cpe:2.3:a:apache:activemq:6.0.1
• Apache » Activemq » Version: 6.1.0
  cpe:2.3:a:apache:activemq:6.1.0
• Apache » Activemq » Version: 6.1.1
  cpe:2.3:a:apache:activemq:6.1.1
• Apache » Activemq » Version: 6.1.2
  cpe:2.3:a:apache:activemq:6.1.2
• Apache » Activemq » Version: 6.1.3
  cpe:2.3:a:apache:activemq:6.1.3
• Apache » Activemq » Version: 6.1.4
  cpe:2.3:a:apache:activemq:6.1.4
• Apache » Activemq » Version: 6.1.5
  cpe:2.3:a:apache:activemq:6.1.5
• Apache » Activemq » Version: 6.1.6
  cpe:2.3:a:apache:activemq:6.1.6
• Apache » Activemq » Version: 6.1.7
  cpe:2.3:a:apache:activemq:6.1.7
• Apache » Activemq » Version: 6.1.8
  cpe:2.3:a:apache:activemq:6.1.8
• Apache » Activemq » Version: 6.1.9
  cpe:2.3:a:apache:activemq:6.1.9
• Apache » Activemq » Version: 6.2.0
  cpe:2.3:a:apache:activemq:6.2.0
• Apache » Activemq Broker » Version: Any
  cpe:2.3:a:apache:activemq_broker:*
• Apache » Activemq Broker » Version: 6.0.0
  cpe:2.3:a:apache:activemq_broker:6.0.0
• Apache » Activemq Web » Version: Any
  cpe:2.3:a:apache:activemq_web:*
• Apache » Activemq Web » Version: 6.0.0
  cpe:2.3:a:apache:activemq_web:6.0.0