Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 13:23:53 +0000 CVE-2026-32642 — Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress per… https://cve.radiocsirt.org/vuln/cve-2026-32642 <p><strong>Affected:</strong> Apache Software Foundation Apache Artemis, Apache Software Foundation Apache ActiveMQ Artemis</p> <p>Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn&#39;t exist with an authenticated user which has the &#34;createDurableQueue&#34; permission but does not have the &#34;createAddress&#34; permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed.</p> <p>This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0.</p> <p>Users are recommended to upgrade to version 2.53.0, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Artemis, Apache Software Foundation Apache ActiveMQ Artemis</p> <p>Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn&#39;t exist with an authenticated user which has the &#34;createDurableQueue&#34; permission but does not have the &#34;createAddress&#34; permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed.</p> <p>This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0.</p> <p>Users are recommended to upgrade to version 2.53.0, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-32642