CVE-2026-108500: Apache Software Foundation Apache ActiveMQ

Описание

Оригинално описание

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups. This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

Засегнати продукти

• Apache Software Foundation Apache ActiveMQ: 6.3.0 преди 6.3.3; 5.19.0 преди 5.19.12; 6.4.0

Вид слабост

• CWE-20 Неправилно валидиране на входните данни

История

Други уязвимости в Apache Software Foundation Apache ActiveMQ

• CVE-2026-108946
• CVE-2026-111822
• 7.5CVE-2026-74761
• 7.5CVE-2026-59878
• 6.5CVE-2026-61487

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-108500
• https://nvd.nist.gov/vuln/detail/CVE-2026-108500
• https://lists.apache.org/thread/0oh4k4ty6hv56d4sydjp26l95f4bsnxt
• http://www.openwall.com/lists/oss-security/2026/11/03/16