ActiveMQ Artemis Release Notes

Apache ActiveMQ Artemis

2.19.3 (NES) - August 12, 2026

Security Fixes

• CVE-2026-27446 (Critical) - Missing authentication for critical function. An unauthenticated attacker could send a Core protocol federation downstream request and make the broker open an outbound federation connection to a broker they control, enabling message injection into and exfiltration from any queue. Downstream federation requests are now authenticated and authorized. Fixed upstream in 2.52.0, which upstream publishes under the org.apache.artemis groupId; no fixed release exists under org.apache.activemq.
• CVE-2022-35278 (Medium) - HTML injection in the web console. An address or queue whose name contained HTML was rendered as markup, allowing an attacker to display misleading content or link an operator to a malicious URL. Table cells now render names as text. Fixed upstream in 2.24.0.
• CVE-2025-27427 (Low) - A user without create-address permission could modify an address routing type. The routing type is now checked when a queue is created. Fixed upstream in 2.40.0.
• Stored cross-site scripting in the web console's message-browse view (High; no CVE assigned; identified by HeroDevs). The Original Queue and Validated User columns rendered message properties as HTML without sanitization, so unlike the sanitized columns covered by CVE-2022-35278 they could execute script. Because the broker copies a queue's name verbatim into the Original Queue property when a message is dead-lettered, a queue named with a payload could run script in the browser of any operator viewing that dead-letter queue. All columns in that view now render as text. This issue has no upstream fix; upstream removed the affected console in 2.40.0 in favour of a separate console project, so every upstream release from 2.24.0 through 2.39.x remains exposed.

Breaking Changes

• Core downstream federation is now deny-by-default. The CVE-2026-27446 fix adds a downstream-authorization attribute on the federations element, listing the roles permitted to deploy federation on the broker. It is empty by default, so a broker with security enabled refuses every incoming downstream federation request until roles are authorized. That refusal is the fix - these requests were previously not authorized at all.
  Deployments using Core downstream federation with security enabled will stop federating after upgrading until the roles are configured on the downstream broker:

  <!-- the user configured on the upstream broker must be in this role -->
  <federations downstream-authorization="federation_role">
     ...
  </federations>
  
  
  A broker with security disabled is unaffected, as are upstream, address and queue federation configured in the usual upstream-initiated direction.

Notes

• Four log messages record the outcome of each downstream federation request, using the same identifiers as upstream so output correlates across versions: AMQ224158 (peer not authenticated) and AMQ224159 (user not in an authorized role) are warnings; AMQ224160 (federation deployed) and AMQ224161 (connection closed, federation undeployed) are informational. Seeing AMQ224158 or AMQ224159 after upgrading is the signal that downstream-authorization needs configuring.
• The two web console fixes ship in the console web application, built from the artemis-hawtio module of the tagged source. That module is not published as a Maven artifact, so neither fix is obtainable from any of the artifacts listed under Published Maven Packages - deployments that run the broker distribution and its console need the console rebuilt from this release. Applications that consume only the client and server libraries were never exposed to either issue.

Full Version: 2.19.1-artemis-server-2.19.3

2.19.2 (NES) - August 11, 2026

Notes

• This release originates from the open-source Apache ActiveMQ Artemis project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.
• This is the initial supported baseline for the 2.19.x line. It is functionally identical to upstream 2.19.1, with no behavioral changes, and contains no vulnerability patches. Security fixes are delivered in subsequent releases on this line.
• Upstream ended maintenance of the 2.19 line at 2.19.1; the Apache project ships from a single active line and maintains no 2.19 branch.

Full Version: 2.19.1-artemis-server-2.19.2