CVE-2014-3576
High · 7.5CVSS
7.5
EPSS
12.8%
Published
Aug 14, 2015
CISA due date
—
The record
The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.activemq:activemq-client | 0 | 5.11.0 |
| Debian:11 | activemq | 0 | 5.6.0+dfsg1-4+deb8u1 |
| Debian:12 | activemq | 0 | 5.6.0+dfsg1-4+deb8u1 |
| Debian:13 | activemq | 0 | 5.6.0+dfsg1-4+deb8u1 |
| Debian:7 | activemq | 0 | 5.6.0+dfsg-1+deb7u1 |
| Debian:8 | activemq | 0 | 5.6.0+dfsg1-4+deb8u1 |
| Ubuntu:14.04:LTS | activemq | 0 | 5.6.0+dfsg-1+deb7u1build0.14.04.1 |
| Ubuntu:16.04:LTS | activemq | 0 | 5.13.2+dfsg-2 |
Related vulnerabilities
- CVE-2015-7559 It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown… Also affects org.apache.activemq:activemq-client
- CVE-2016-3088 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… Also affects org.apache.activemq:activemq-client
- CVE-2015-5254 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in… Also affects org.apache.activemq:activemq-client
- CVE-2015-1830 Directory traversal vulnerability in the fileserver upload/download functionality for… Also affects org.apache.activemq:activemq-client
- CVE-2021-26117 The optional ActiveMQ LDAP login module can be configured to use anonymous access to the… Also affects activemq
- CVE-2026-81644 DoS vulnerability in the preview service module. CWE-264
- CVE-2026-49315 DoS vulnerability in the input device module. CWE-264
- CVE-2026-49313 Permission control vulnerability in the app lock module. CWE-264