Arbitrary Queue Creation Vulnerability in Apache Artemis and ActiveMQ Artemis
CVE-2026-49362

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Artemis; Apache ActiveMQ Artemis
Vendor: CVE Published:; 10 September 2026

What is CVE-2026-49362?

A vulnerability exists that allows an unauthenticated remote attacker to create arbitrary durable queues via the CORE protocol. This could enable unauthorized manipulation of the broker's state, potentially leading to service disruptions or denial of service. Users are advised to update to version 2.57.0 to mitigate this issue.

Affected Version(s)

Apache ActiveMQ Artemis 1.0.0 <= 2.44.0

Apache Artemis 2.50.0 <= 2.56.0

References

https://lists.apache.org/thread/3828w4tm5mfpflmoprb5oxfgw...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 10, 2026
Vulnerability Reserved
May 29, 2026

Credit

Domenico Francesco Bruscino

Fedrick Sequeira

Mike Read

CVE-2026-49362 Data

JSON