Most recent entries from all

bdu:2026-05819

2026-10-04T07:34:30.457310+00:00

bdu:2026-05819

BIT-activemq-2022-41678 — Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

2026-10-04T07:34:30.457356+00:00

Affected: Bitnami: activemq

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.

In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia

org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.

Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.

1 Call newRecording.

2 Call setConfiguration. And a webshell data hides in it.

3 Call startRecording.

4 Call copyTo method. The webshell will be written to a .jsp file.

The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

certfr-2024-avi-0228 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

2026-10-04T07:34:30.457405+00:00

certfr-2024-avi-0228

EUVD-2026-258356

2026-10-04T07:34:30.457423+00:00

EUVD-2026-258356

fkie_cve-2022-41678

2026-10-04T07:34:30.457435+00:00

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.

In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia

org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.

1 Call newRecording.

2 Call setConfiguration. And a webshell data hides in it.

3 Call startRecording.

4 Call copyTo method. The webshell will be written to a .jsp file.

GHSA-53v4-42fg-g287 — Apache ActiveMQ Deserialization of Untrusted Data vulnerability

2026-10-04T07:34:30.457469+00:00

Affected: Maven: org.apache.activemq:apache-activemq

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.

In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia

org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.

Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection.

And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.

1 Call newRecording.

2 Call setConfiguration. And a webshell data hides in it.

3 Call startRecording.

4 Call copyTo method. The webshell will be written to a .jsp file.

gsd-2022-41678

2026-10-04T07:34:30.457502+00:00

gsd-2022-41678

ICSA-25-261-04 — Multiple Open-Source Software Vulnerabilities in Hitachi Energy Asset Suite Product

2026-10-04T07:34:30.457514+00:00

Hitachi Energy is aware of multiple reported vulnerabilities that affect the Asset Suite product versions mentioned in this document below. If exploited these vulnerabilities can potentially impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

OESA-2023-1925 — activemq security update

2026-10-04T07:34:30.457536+00:00

Affected: openEuler:20.03-LTS-SP1: activemq, openEuler:20.03-LTS-SP3: activemq, openEuler:22.03-LTS: activemq, openEuler:22.03-LTS-SP1: activemq, openEuler:22.03-LTS-SP2: activemq

The most popular and powerful open source messaging and Integration Patterns server. Security Fix(es): Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection. And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0. (CVE-2022-41678)

RHSA-2024:2944 — Red Hat Security Advisory: AMQ Broker 7.12.0.OPR.1.GA Container Images release and security update

2026-10-04T07:34:30.457572+00:00

golang.org/x/crypto: empty plaintext packet causes panic golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters prometheus/client_golang: Denial of service using InstrumentHandlerCounter golang: net/http: handle server errors after sending GOAWAY golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE golang: regexp/syntax: limit memory used by parsing regexps golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption golang: net/http, net/textproto: denial of service from excessive memory allocation golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption golang: go/parser: Infinite loop in parsing golang: html/template: backticks not treated as string delimiters golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of JavaScript whitespace golang: html/template: improper handling of empty HTML attributes

UBUNTU-CVE-2022-41678

2026-10-04T07:34:30.457620+00:00

Affected: Ubuntu:Pro:16.04:LTS: activemq, Ubuntu:Pro:18.04:LTS: activemq, Ubuntu:Pro:20.04:LTS: activemq, Ubuntu:22.04:LTS: activemq

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

WID-SEC-W-2023-3022 — Apache ActiveMQ: Schwachstelle ermöglicht Codeausführung

2026-10-04T07:34:30.457651+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache ActiveMQ ausnutzen, um beliebigen Programmcode auszuführen.