Skip to content
VulniPulse
Sign in
Advisory severityUnratedApache Software Foundation Updated

Advisory [CVE-2026-108500] Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups

This security Apache Software Foundation advisory covers CVE-2026-108500 affecting Apache ActiveMQ.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-108500 Source published Source updated

VulniPulse record published Record updated

CVE-2026-108500
Affected products & platforms
Apache Software FoundationMessagingActiveMQ
Open source advisory

Get an email when Apache Software Foundation Messaging (ActiveMQ/Kafka/Pulsar) publishes the next one.

See Apache Software Foundation Messaging (ActiveMQ/Kafka/Pulsar)'s last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache Software Foundation Messaging (ActiveMQ/Kafka/Pulsar)

Summary

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.

This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.

Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

Affected versions
  • 6.3.0 before 6.3.3
  • 5.19.0 before 5.19.12

Official advisory · medium-confidence parse· fetched 15 hours ago·verify at source

Fixed versions
  • 6.3.3
  • 5.19.12
  • 6.4.0

Official advisory · medium-confidence parse· fetched 15 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

Official advisory · medium-confidence parse· fetched 15 hours ago·verify at source

More Apache Software Foundation advisories

All Apache Software Foundation advisories

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alertsSee app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.