CriticalCVE-2026-34197

    DBI: Improper Input Validation (CVE-2026-34197)

    Published Last modified In CISA KEV since Sources: BSI

    Share

    What is affected, what to do

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console.

    The vulnerability is being actively exploited; treat it as a priority. Update Apache ActiveMQ Broker to version 5.19.4, Apache ActiveMQ Broker to version 6.2.3, Apache ActiveMQ All to version 5.19.4. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Apache ActiveMQ Broker lt *..5.19.4
    • Apache ActiveMQ Broker lt 6.0.0..6.2.3
    • Apache ActiveMQ All lt *..5.19.4
    • Apache ActiveMQ All lt 6.0.0..6.2.3
    • Apache ActiveMQ lt *..5.19.4
    • Apache ActiveMQ lt 6.0.0..6.2.3
    Fixed in
    • Apache ActiveMQ Broker 5.19.4
    • Apache ActiveMQ Broker 6.2.3
    • Apache ActiveMQ All 5.19.4
    • Apache ActiveMQ All 6.2.3
    • Apache ActiveMQ 5.19.4
    • Apache ActiveMQ 6.2.3

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    8.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    8.8

    CVSS v3

    Severity High on the scale from 0 to 10.

    Source: BSI

    98.3 %

    EPSS score

    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

    Source: FIRST EPSS, percentile 99.92

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    175.86 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploitedSource: VulnCheck KEV (opens in a new tab) How we classify
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    8.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    8.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    98.3 %
    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.92
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · not automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 17 April 2026
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-20, CWE-94, CWE-78

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This CVE sits on KEV because an authenticated web-console user can achieve full remote code execution on the broker JVM through a default-enabled HTTP endpoint — typically with the privileges of a central integration service wired into many back-end systems. Attackers routinely chain weak or default console credentials with the Jolokia path, so any ActiveMQ instance with a reachable console must be treated as highly exposed, and the exploitation likelihood sits in the top band. Rank remediation as: (1) brokers with internet-facing or flat-network consoles — emergency patch within 24 h; (2) internal brokers using shared admin credentials — patch within the next standard change window; (3) embedded brokers inside applications — track via dependency scans and ship with the next application release. Even without the CISA ransomware flag, the asset is an attractive pivot into ERP, OT/SCADA and B2B integration estates.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Patch now: upgrade Apache ActiveMQ to 5.19.4 (5.x branch) or 6.2.3 (6.x branch). Applies equally to Broker, "All" distribution and Classic. Rolling upgrade across a network-of-brokers is supported but document the order.
      • If patching has to wait: block the /api/jolokia/ endpoint and the web console at the reverse proxy, ingress controller or local firewall. Permit access only from a dedicated management network, never from production or internet-facing zones.
      • Harden the Jolokia access policy: edit jolokia-access.xml inside the web-console WAR and explicitly deny exec operations against org.apache.activemq:* MBeans (<deny><mbean><name>org.apache.activemq:*</name><operation>*</operation></mbean></deny>), then redeploy the console.
      • Inventory every account that can reach the web console (activemq.xml, users.properties, jetty-realm.properties), remove any default credentials (admin:admin) and rotate passwords. Authenticated access is the exploitation prerequisite.
      • Inspect broker JVMs for active Spring-XML loads from external sources (running processes, outbound HTTP(S) from the broker process). On suspicion, isolate the broker, capture heap and thread dumps, and treat as compromise.
      • CMDB sweep: find every ActiveMQ instance including embedded brokers inside Java applications, container images and legacy integration servers. Rebuild container images in the registry — do not just restart running pods.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: expose the Jolokia path /api/jolokia/* and the web-console port (default 8161/TCP) only to a defined admin VLAN. Keep OpenWire (61616/TCP), AMQP (5672), MQTT (1883) and STOMP (61613) open for message clients, management strictly separated.
      • WAF / reverse-proxy rule: block HTTP requests to /api/jolokia/ carrying "type":"EXEC" or any MBean parameter containing addNetworkConnector, addConnector, brokerConfig or xbean: in the JSON body. Alternatively drop all requests matching /api/jolokia/exec/org.apache.activemq:*.
      • Jolokia policy on allowlist: whitelist only the read operations monitoring actually needs (QueueSize, EnqueueCount, etc.). Combine with egress filtering so the broker host cannot fetch external HTTP/HTTPS, preventing ResourceXmlApplicationContext from loading remote XML.
      • Endpoint hardening: run the broker JVM under a dedicated UID with no shell, enforce an SELinux/AppArmor profile that blocks fork/exec of sh, bash, curl, wget from the Java process. On Windows: Software Restriction Policy or WDAC against child processes of the ActiveMQ service.
      • IAM least privilege: distinct roles for message clients and web-console users, admin access via an MFA jump host only. Application service accounts must not be allowed to log into the console.
      • Snort/Suricata: alert and drop on HTTP URI /api/jolokia/ combined with content brokerConfig=xbean: or addNetworkConnector.

    3. Runbook step 3

      Detection rules

      • Web-server / Jetty access log: requests to /api/jolokia/exec/org.apache.activemq:* or POSTs to /api/jolokia/ returning HTTP 200, especially from non-management source IPs. KQL sketch: W3CIISLog | where csUriStem has "/api/jolokia/" and csMethod == "POST".
      • Sysmon EID 1 / auditd execve: process ancestry showing java spawning /bin/sh, cmd.exe, powershell.exe, curl, wget, base64 as a child of the ActiveMQ broker. Sigma shape: parent_image|endswith: 'java' AND command line containing shell primitives, with ActiveMQ context.
      • Network telemetry (Zeek http.log): outbound HTTP(S) GETs from the broker host to external URLs returning text/xml or ending in .xml — a signature of a loaded Spring context. Baseline: a broker normally talks to clients, not outbound to the web.
      • ActiveMQ broker log (activemq.log): entries referencing ResourceXmlApplicationContext, brokerConfig, addNetworkConnector or stack traces from org.springframework.context.support occurring after startup.
      • EDR: new persistent outbound connections from the JVM to broker peers that are not in configured network connectors (unexpected OpenWire sessions after an addNetworkConnector call). Alert on netstat deltas per broker.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

    Source: BSI WID Portal

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    —DBI
    • < 1.650
    • 1.650
    —gnutls
    • 0
    • 3.6.13 – < 3.8.13
    • < 3.8.13
    • —
    • 3.8.13
    • 3.8.13
    —libxml2
    • < 2.14.5
    • 2.14.5
    acl projectacl
    • < 2.4.0
    • 2.4.0
    Apache Software FoundationApache ActiveMQ
    • 5.14.0 – < 5.19.7
    • 6.0.0 – < 6.1.9
    • 6.0.0 – < 6.2.2
    • 6.0.0 – < 6.2.3
    • 6.0.0 – < 6.2.4
    • 6.0.0 – < 6.2.5
    • 6.0.0 – < 6.2.6
    • 6.0.0 – < 6.2.7
    • 6.2.0 – < 6.2.1
    • < 5.19.2
    • < 5.19.3
    • < 5.19.4
    • < 5.19.6
    • < 5.19.7
    • < 5.19.8
    • 5.19.7
    • 6.1.9
    • 6.2.2
    • 6.2.3
    • 6.2.4
    • 6.2.5
    • 6.2.6
    • 6.2.7
    • 6.2.1
    • 5.19.2
    • 5.19.3
    • 5.19.4
    • 5.19.6
    • 5.19.7
    • 5.19.8
    Apache Software FoundationApache ActiveMQ All
    • 5.14.0 – < 5.19.7
    • 6.0.0 – < 6.2.2
    • 6.0.0 – < 6.2.3
    • 6.0.0 – < 6.2.4
    • 6.0.0 – < 6.2.5
    • 6.0.0 – < 6.2.6
    • 6.0.0 – < 6.2.7
    • < 5.19.3
    • < 5.19.4
    • < 5.19.6
    • < 5.19.7
    • < 5.19.8
    • 5.19.7
    • 6.2.2
    • 6.2.3
    • 6.2.4
    • 6.2.5
    • 6.2.6
    • 6.2.7
    • 5.19.3
    • 5.19.4
    • 5.19.6
    • 5.19.7
    • 5.19.8
    Apache Software FoundationApache ActiveMQ All Module
    • 6.0.0 – < 6.1.9
    • 6.2.0 – < 6.2.1
    • < 5.19.2
    • 6.1.9
    • 6.2.1
    • 5.19.2
    Apache Software FoundationApache ActiveMQ Broker
    • 5.14.0 – < 5.19.7
    • 6.0.0 – < 6.2.2
    • 6.0.0 – < 6.2.3
    • 6.0.0 – < 6.2.4
    • 6.0.0 – < 6.2.5
    • 6.0.0 – < 6.2.6
    • 6.0.0 – < 6.2.7
    • < 5.19.3
    • < 5.19.4
    • < 5.19.6
    • < 5.19.7
    • < 5.19.8
    • 5.19.7
    • 6.2.2
    • 6.2.3
    • 6.2.4
    • 6.2.5
    • 6.2.6
    • 6.2.7
    • 5.19.3
    • 5.19.4
    • 5.19.6
    • 5.19.7
    • 5.19.8
    Distribution and container packages (10)

    Downstream packages (e.g. Bitnami, Debian, Ubuntu, Red Hat). Versions refer to the distribution, not the vendor.

    Distribution and container packages
    Affected versionsFixed in
    bitnamiactivemq
    • 6.0.0
    • —
    • 6.2.7
    • 5.19.8
    bitnamijre
    • 1.9.0
    • 9.0.0
    • —
    • —
    bitnamithrift
    • —
    • 0.23.0
    bitnamitomcat
    • 10.0.0
    • 10.1.0
    • 11.0.0
    • 7.0.100
    • —
    • 10.1.37
    • —
    • 11.0.23
    • —
    • 9.0.101
    From bundled advisories, not CVE-specific (129)

    Product list of a bundled advisory that does not state which product this CVE affects.

    Products from bundled advisories
    Affected versionsFixed in
    —jackson-databind (FasterXML Jackson, Java)
    • com.fasterxml.jackson.core:jackson-databind 2.10.0 - 2.18.11
    • com.fasterxml.jackson.core:jackson-databind 2.19.0 - 2.21.7
    • com.fasterxml.jackson.core:jackson-databind 2.22.0 - 2.22.3
    • tools.jackson.core:jackson-databind 3.0.0 - 3.1.7
    • tools.jackson.core:jackson-databind 3.2.0 - 3.2.3
    • 2.18.12
    • 2.21.8
    • 2.22.4
    • 3.1.8
    • 3.2.4
    AmazonCorretto
    • < 11.0.32.9.1
    • < 8.502.07.1
    • 11.0.32.9.1
    • 8.502.07.1
    AtlassianBamboo Data Center
    • < 10.2.20
    • < 12.1.8
    • 10.2.20
    • 12.1.8
    AtlassianBamboo Data Center LTS
    • < 10.2.19
    • < 10.2.22
    • < 10.2.23
    • < 12.1.10
    • < 12.1.11
    • < 12.1.7
    • < 9.6.26
    • 10.2.19
    • 10.2.22
    • 10.2.23
    • 12.1.10
    • 12.1.11
    • 12.1.7
    • 9.6.26
    AtlassianBamboo LTS
    • < 10.2.21
    • < 10.2.24
    • < 12.1.12
    • < 12.1.9
    • 10.2.21
    • 10.2.24
    • 12.1.12
    • 12.1.9
    AtlassianBitbucket
    • < 10.5.1
    • 10.5.1
    AtlassianBitbucket Data Center
    • < 10.2.4
    • < 10.3.1
    • < 10.4.2
    • < 10.4.3
    • < 9.4.21
    • 10.2.4
    • 10.3.1
    • 10.4.2
    • 10.4.3
    • 9.4.21
    AtlassianBitbucket Data Center LTS
    • < 10.2.2
    • < 10.2.6
    • < 10.2.7
    • < 9.4.19
    • < 9.4.23
    • < 9.4.24
    • 10.2.2
    • 10.2.6
    • 10.2.7
    • 9.4.19
    • 9.4.23
    • 9.4.24
    AtlassianBitbucket LTS
    • < 10.2.8
    • < 10.3.2
    • < 9.4.22
    • < 9.4.26
    • 10.2.8
    • 10.3.2
    • 9.4.22
    • 9.4.26
    AtlassianConfluence
    • < 11.0.0
    • 11.0.0
    AtlassianConfluence Data Center
    • < 10.2.13
    • < 9.2.21
    • 10.2.13
    • 9.2.21
    AtlassianConfluence Data Center LTS
    • < 10.2.11
    • < 10.2.15
    • < 10.2.17
    • < 10.2.18
    • < 9.2.20
    • < 9.2.23
    • < 9.2.24
    • < 9.2.25
    • 10.2.11
    • 10.2.15
    • 10.2.17
    • 10.2.18
    • 9.2.20
    • 9.2.23
    • 9.2.24
    • 9.2.25
    AtlassianConfluence LTS
    • < 10.2.14
    • 10.2.14

    Vendors and products

    Affected operating systems

    Affected operating systems
    Linuxubuntuawsbionic
    Linuxubuntuawsjammy
    Linuxubuntuawsnoble
    Linuxubuntuawsresolute
    Linuxubuntuawsxenial
    Linuxubuntuaws-6.8jammy
    Linuxubuntuaws-hwexenial
    Linuxubuntuazurejammy
    Linuxubuntuazurenoble
    Linuxubuntuazureresolute
    Linuxubuntuazurexenial
    Linuxubuntuazure-4.15bionic
    Linuxdebiancifs-utilstrixie
    Linuxredhatenterprise_linux7.0
    Linuxredhatenterprise_linux10.0
    Linuxredhatenterprise_linux10.2
    Linuxredhatenterprise_linux8.0
    Linuxredhatenterprise_linux9.8
    Linuxredhatenterprise_linux6.0
    Linuxredhatenterprise_linux9.0
    Linuxredhatenterprise_linux_aus8.4
    Linuxredhatenterprise_linux_aus8.6
    Linuxredhatenterprise_linux_els7.0
    Linuxredhatenterprise_linux_eus8.4

    Weakness classes (CWE)

    • CWE-20Improper Input Validation

      Class

      The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

      Entry at MITRE CWE-20

    • CWE-94Improper Control of Generation of Code ('Code Injection')

      Base

      The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

      Entry at MITRE CWE-94

    • CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

      Base

      The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

      Entry at MITRE CWE-78

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    PoC-in-GitHub (nomi-sec)CVE-2026-34197 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-34197 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)apache-activemq-rce-research (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-34197 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-34197 (opens in a new tab)github.comPoC (publicly reported)reported, not verified

    References & sources

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Record modifiedRed Hat ADP

      1 individual change: Affected versions (publisher)

      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Affected versions (publisher)changed
      Red Hat AMQ Broker 7, Red Hat Data Grid 8, Red Hat Enterprise Linux 8 (+6)
      Red Hat AMQ Broker 7, Red Hat Data Grid 8, Red Hat Enterprise Linux 8 (+6)

      Source identifier: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

    2. NVD analysis modifiedNVD

      Show 3 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Reference typeadded
      —
      redhat-SADP: https://access.redhat.com/security/cve/CVE-2026-34197 Types: Third Party Advisory
      Reference typeadded
      —
      redhat-SADP: https://bugzilla.redhat.com/show_bug.cgi?id=2455869 Types: Third Party Advisory
      Reference typeadded
      —
      redhat-SADP: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.json Types: Third Party Advisory

      Source identifier: nvd@nist.gov

    One NVD translation into another language is hidden.

    Linked CVEs

    Linked CVEs
    CriticalCVE-2026-9698DBI versions before 1.648 for Perl saved errors in a limited-sized buffer9.8—
    HighCVE-2026-8177SHLOMIF XML::LibXML: Out-of-bounds Read7.5—
    HighCVE-2026-66144Apache Neethi: Remote PolicyReference fetch lacks resource bounds7.5—
    HighCVE-2026-66143Apache Neethi: Missing global alternative-output budget across policy computation paths7.5—
    HighCVE-2026-66142Apache Neethi: Uncontrolled recursion in policy processing7.5—
    MediumCVE-2026-66053Apache Thrift: Python TSSLSocket Hostname Matcher Import5.9—
    CriticalCVE-2026-64530Linux Kernel: Use After Free9.8—
    MediumCVE-2026-6238Buffer overread in ns_printrrf with corrupted RDATA field6.5—
    MediumCVE-2026-60147Oracle Java SE: security vulnerability6.5—
    HighCVE-2026-60081DBI::ProfileData versions before 1.651 for Perl do not limit the path index7.5—
    MediumCVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy6.5—
    HighCVE-2026-59858Vim: Arbitrary Code Execution via C Omni-Completion7.8—
    HighCVE-2026-5928Potential buffer under-read in ungetwc7.5—
    CriticalCVE-2026-59084Apache Tomcat: EncryptInterceptor requirements not clearly documented9.1—
    CriticalCVE-2026-59083Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass9.1—
    CriticalCVE-2026-58016Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"9.1—
    HighCVE-2026-57456Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings7.8—
    HighCVE-2026-57455Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument7.8—
    MediumCVE-2026-55956Apache Tomcat: Security constraints for default servlet ignored method6.5—
    MediumCVE-2026-55955Apache Tomcat: EncryptInterceptor not protected against replay attacks6.5—
    HighCVE-2026-55693Vim: Out-of-bounds Write in Spell File Word Count7.8—
    MediumCVE-2026-55655Red Hat: Improper Restriction of Communication Channel to Intended Endpoints6.1—
    MediumCVE-2026-55653Red Hat: Double Free6.5—
    CriticalCVE-2026-55276Apache Tomcat: Logged effective web.xml is incomplete9.1—
    Show 125 more CVEs
    Linked CVEs
    MediumCVE-2026-5522QRadar contains hard-coded credentials6.7—
    HighCVE-2026-55153Swaldman Mchange-commons-java: Unsafe Reflection7.1—
    MediumCVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties5.3—
    MediumCVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)5.3—
    HighCVE-2026-54513FasterXML Jackson-databind: Incomplete List of Disallowed Inputs8.1—
    HighCVE-2026-54512FasterXML Jackson-databind: Incomplete List of Disallowed Inputs8.1—
    CriticalCVE-2026-5450scanf %mc off-by-one heap buffer overflow9.8—
    HighCVE-2026-54475Apache ActiveMQ Broker: Missing Authorization7.5—
    HighCVE-2026-54370acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl6.3—
    HighCVE-2026-54369acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions7.1—
    HighCVE-2026-5435Potential buffer overflow in ns_sprintrrf TSIG handling path8.6—
    HighCVE-2026-53917Apache ActiveMQ: Memory Allocation with Excessive Size Value7.5—
    HighCVE-2026-53916Apache ActiveMQ: Memory Allocation with Excessive Size Value7.5—
    CriticalCVE-2026-53434Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector9.1—
    HighCVE-2026-53404Apache Tomcat: Bad ornext processing in RewriteValve7.3—
    HighCVE-2026-53359Linux Kernel: Use After Free8.8—
    CriticalCVE-2026-53266Linux Kernel Out-of-Bounds Write Vulnerability8.8Actively exploited
    HighCVE-2026-53071Linux Kernel: security vulnerability8.8—
    HighCVE-2026-53059Linux Kernel: Out-of-Bounds Write7.8—
    CriticalCVE-2026-53006Linux Kernel: Expired Pointer Dereference9.8—
    CriticalCVE-2026-52993Linux Kernel: Release of Invalid Pointer or Reference9.8—
    HighCVE-2026-52923Linux Kernel: Improper Input Validation7.8—
    HighCVE-2026-5260Gnutls: gnutls: information disclosure via heap overread in rsa key exchange8.2—
    HighCVE-2026-50734Apache ActiveMQ: Memory Allocation with Excessive Size Value7.5—
    HighCVE-2026-50722IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload8.1—
    HighCVE-2026-50721IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload8.1—
    HighCVE-2026-49434Apache ActiveMQ Broker: Improper Input Validation7.5—
    HighCVE-2026-49432Apache ActiveMQ: Improper Input Validation7.5—
    MediumCVE-2026-49270Apache ActiveMQ Broker: Exposure of Sensitive Information Through Metadata5.9—
    HighCVE-2026-49157Apache ActiveMQ: Incorrect Default Permissions8.8—
    HighCVE-2026-48864Red Hat Enterprise Linux 10: Out-of-bounds Write7.8—
    HighCVE-2026-4878Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()7.0—
    HighCVE-2026-47063Oracle Java SE: security vulnerability7.5—
    LowCVE-2026-47059Oracle Java SE: Denial of Service3.7—
    HighCVE-2026-47058Oracle Java SE: Deserialization of Untrusted Data7.4—
    HighCVE-2026-47057Oracle Java SE: Uncontrolled Resource Consumption7.5—
    MediumCVE-2026-47027Oracle Java SE: Improper Access Control5.3—
    MediumCVE-2026-47021Oracle Java SE: Denial of Service5.3—
    LowCVE-2026-47010Oracle Java SE: security vulnerability3.7—
    MediumCVE-2026-46968Oracle Java SE: Improper Access Control5.9—
    MediumCVE-2026-46917Oracle Java SE: Denial of Service5.3—
    MediumCVE-2026-46605Apache ActiveMQ Broker: Improper Authorization4.3—
    HighCVE-2026-46331Linux Kernel: security vulnerability7.8—
    HighCVE-2026-46259Linux Kernel: Use After Free7.8—
    HighCVE-2026-46227Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-46209Linux Kernel: security vulnerability7.8—
    HighCVE-2026-46189Linux Kernel: Double Free7.8—
    HighCVE-2026-46150Linux Kernel: security vulnerability7.8—
    HighCVE-2026-46145Linux Kernel: security vulnerability7.8—
    CriticalCVE-2026-46135Linux Kernel: security vulnerability9.8—
    HighCVE-2026-46117Linux Kernel: security vulnerability7.8—
    HighCVE-2026-46116Linux Kernel: Use After Free7.8—
    HighCVE-2026-46113Linux Kernel: Use After Free8.8—
    HighCVE-2026-46090Linux Kernel: Use After Free7.8—
    HighCVE-2026-46086Linux Kernel: NULL Pointer Dereference7.0—
    HighCVE-2026-46054Linux Kernel: security vulnerability7.5—
    HighCVE-2026-45984Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-45505Apache ActiveMQ Broker: Code Injection8.8—
    CriticalCVE-2026-44930Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository9.8—
    MediumCVE-2026-44618Apache CXF: XXE vulnerability in WS-Transfer functionality5.3—
    HighCVE-2026-44431urllib3: Sensitive headers forwarded across origins in proxied low-level redirects5.3—
    HighCVE-2026-44417Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)7.5—
    HighCVE-2026-43869Apache Thrift: TSSLTransportFactory.java hostname verification7.3—
    HighCVE-2026-43499Linux Kernel: Use After Free7.8—
    HighCVE-2026-43450Linux Kernel: Out-of-Bounds Read7.1—
    HighCVE-2026-43279Linux Kernel: security vulnerability7.8—
    CriticalCVE-2026-43198Linux Kernel: security vulnerability9.8—
    HighCVE-2026-43116Linux Kernel: Race Condition7.8—
    HighCVE-2026-43112Linux Kernel: Out-of-Bounds Read8.8—
    HighCVE-2026-43056Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-42588Apache ActiveMQ Broker: Code Injection8.1—
    HighCVE-2026-42404Apache Neethi: Unrestricted HTTP Redirect Following in Policy References7.2—
    HighCVE-2026-42403Apache Neethi: Circular Policy Reference Infinite Loop7.5—
    HighCVE-2026-42402Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS7.5—
    MediumCVE-2026-42253Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties6.1—
    HighCVE-2026-42198pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS7.5—
    MediumCVE-2026-42015Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling5.3—
    HighCVE-2026-42013Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name8.2—
    HighCVE-2026-42012Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans7.1—
    HighCVE-2026-42011Gnutls: gnutls: security bypass due to incorrect name constraint handling7.4—
    CriticalCVE-2026-42010Gnutls: gnutls: authentication bypass via nul character in username9.8—
    HighCVE-2026-42009Gnutls: gnutls: denial of service via dtls packet reordering vulnerability7.5—
    HighCVE-2026-41603Apache Thrift: Java TSSLTransportFactory hostname verification7.4—
    MediumCVE-2026-41411Vim: Command injection via backtick expansion in tag filenames6.6—
    HighCVE-2026-41254little cms color engine: Integer Overflow or Wraparound7.5—
    HighCVE-2026-41044Apache ActiveMQ: Code Injection8.8—
    MediumCVE-2026-41043Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues6.5—
    HighCVE-2026-40466Apache ActiveMQ Broker: Code Injection8.8—
    HighCVE-2026-40046Apache ActiveMQ: Integer Overflow or Wraparound7.5—
    HighCVE-2026-39304Apache ActiveMQ: Allocation of Resources Without Limits or Throttling7.5—
    HighCVE-2026-3833Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison7.4—
    CriticalCVE-2026-34197Apache ActiveMQ Improper Input Validation Vulnerability8.8Actively exploited
    HighCVE-2026-33846Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly7.5—
    CriticalCVE-2026-33845Gnutls: gnutls: denial of service via dtls zero-length fragment9.1—
    MediumCVE-2026-33558Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output5.3—
    HighCVE-2026-33416LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`7.5—
    MediumCVE-2026-33227Apache ActiveMQ: Path Traversal4.3—
    HighCVE-2026-31692Linux Kernel: security vulnerability7.1—
    HighCVE-2026-31488Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-31419Linux Kernel: Race Condition7.8—
    MediumCVE-2026-31411Linux Kernel: security vulnerability5.5—
    MediumCVE-2026-25749Heap Overflow in Vim6.6—
    HighCVE-2026-23216Linux Kernel: Use After Free8.4—
    CriticalCVE-2026-16441Eclipse OpenJ9 : Method resolution default method precedence failure9.6—
    CriticalCVE-2026-16439Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow9.1—
    HighCVE-2026-16243Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero7.5—
    HighCVE-2026-15392HMBRAND DBD::File: Path Traversal7.7—
    HighCVE-2026-15308Python Software Foundation CPython: Uncontrolled Resource Consumption7.5—
    CriticalCVE-2026-15043HMBRAND DBI::SQL::Nano: Use of Incorrect Operator9.8—
    CriticalCVE-2026-14739HMBRAND DBI: Out-of-bounds Write9.8—
    HighCVE-2026-14476Red Hat: Relative Path Traversal8.0—
    HighCVE-2026-14474Red Hat: Initialization of a Resource with an Insecure Default8.8—
    HighCVE-2026-14380DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile8.8—
    HighCVE-2026-12505Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall7.8—
    HighCVE-2026-12413IKEv2 Denial of Service via malformed fragmentation7.5—
    CriticalCVE-2026-10879HMBRAND DBI: Out-of-bounds Write9.8—
    HighCVE-2026-10846Insufficient verification that responses belong to a query7.5—
    HighCVE-2025-71089Linux Kernel: Use After Free7.8—
    HighCVE-2025-71066Linux Kernel: Race Condition7.8—
    HighCVE-2025-66168Apache ActiveMQ: Integer Overflow or Wraparound8.8—
    LowCVE-2025-6170Libxml2: stack buffer overflow in xmllint interactive shell command handling2.5—
    CriticalCVE-2025-48913Apache CXF: Untrusted JMS configuration can lead to RCE9.8—
    HighCVE-2025-40026Linux Kernel: security vulnerability7.9—
    HighCVE-2025-13151GnuTLS Libtasn1: Stack-Based Buffer Overflow7.5—
    CriticalCVE-2025-10263Arm C1-Ultra: Race Condition9.3—

    Linked advisories

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-34197
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-34197"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-34197.svg?lang=en" alt="CVE-2026-34197 – NEOSEC Intel" height="20"></a>