[<prev] [next>] [day] [month] [year] [list]
Message-ID: <3e261c48-1447-f163-0836-49b80c80e9d4@apache.org>
Date: Tue, 03 Nov 2026 16:10:05 +0000
From: Matt Pavlovich <mattrpav@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-108500: Apache ActiveMQ: LDAPAuthorizationMap allows
authorization bypass via DN injection
Severity: Moderate
Affected versions:
- Apache ActiveMQ 6.3.0 before 6.3.3
- Apache ActiveMQ 5.19.0 before 5.19.12
- Apache ActiveMQ 6.4.0 unaffected
Description:
Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.
This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Credit:
Rishabh Soni (Azmendus) <rishabhv704@...il.com> (finder)
References:
https://activemq.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-108500
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
