Apache ActiveMQ Flaws Enable Path Traversal and TLS DoS

Apache disclosed two vulnerabilities affecting multiple ActiveMQ components, including Client, Broker, and bundled distributions. CVE-2026-33227 is a low-severity pathname restriction flaw that lets an authenticated user manipulate a supplied key value to traverse the classpath in two cases: when creating a STOMP consumer and when browsing messages through the web console. Apache warned the issue could expose classpath resource loading and potentially be chained with another attack. The flaw affects the 5.x branch before 5.19.3 and the 6.x branch from 6.0.0 before 6.2.2, but Apache said those initial fixes were incomplete on Windows because of path separator handling, and recommended upgrading instead to 5.19.4 or 6.2.3.

Apache also published CVE-2026-39304, an important denial-of-service flaw in ActiveMQ's NIO SSL transports caused by incorrect handling of TLS 1.3 KeyUpdate messages. A client can repeatedly trigger updates and exhaust broker memory in the SSL engine, causing out-of-memory crashes and service disruption. Apache added that related handshake handling is also broken for earlier TLS versions such as TLS 1.2, though those cases lead to hung connections rather than memory exhaustion. The DoS issue affects the 5.x branch before 5.19.4 and the 6.x branch from 6.0.0 before 6.2.4; users are advised to upgrade to 5.19.5 or 6.2.4.