Input Validation Vulnerability in Apache ActiveMQ Impacting LDAP Authorization

CVE-2026-108500

What is CVE-2026-108500?

An input validation vulnerability exists in Apache ActiveMQ when configured with the LDAPAuthorizationMapPlugin. This flaw permits an authenticated attacker to create or access a destination with a specially crafted name that includes LDAP DN special characters, such as comma, plus, equals, or backslash. This manipulation compromises the LDAP search base used for access control list (ACL) checks. Users are advised to promptly upgrade to version 6.4.0, 6.3.3, or 5.19.12 to mitigate this issue.

References