OSSEVA FOR ACTIVEMQ CLASSIC
ActiveMQ Classic 5.x — still running, no longer patched.
Apache ships ActiveMQ Classic fixes on the current 5.19.x line and on 6.x. If your brokers are on 5.15, 5.16, 5.17 or 5.18 — and most long-lived estates are — the advisories keep coming and the patches do not. OSSeva backports them to the line you are on.
Why now
Only the newest 5.x line receives fixes
Apache ActiveMQ Classic maintains the current 5.19.x series alongside 6.x. Releases continue steadily on those lines — 5.19.11 shipped on 2 September 2026 — but nothing is backported to 5.15, 5.16, 5.17 or 5.18. Those are the versions that shipped with a decade of enterprise integrations built on top of them.
CVE-2023-46604 proved how exposed this installed base is
The OpenWire unauthenticated remote code execution flaw was exploited in the wild by ransomware operators within days of disclosure. It affected every 5.x line below the patched releases. Organisations that could not upgrade on that timeline discovered exactly how little room a broker upgrade leaves you during an active incident.
The migration to Artemis is a rewrite, not an upgrade
ActiveMQ Artemis is a different broker with a different persistence engine, different clustering and different configuration. It is the right destination for most estates, but it is a project measured in quarters. Extended support on Classic is what makes that project a planned migration rather than an emergency one.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 5.15.x(No upstream fixes — OSSeva backported) | EOL | Clean |
| 5.16.x(No upstream fixes — OSSeva backported) | EOL | Clean |
| 5.17.x(No upstream fixes — OSSeva backported) | EOL | Clean |
| 5.18.x(No upstream fixes — OSSeva backported) | EOL | Clean |
| 5.19.x(Upstream maintained) | Current | Clean |
| 6.x(Upstream maintained) | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
Backported CVE patches for ActiveMQ Classic 5.15–5.18.
- Security backports to your 5.x line, no version jump required
- OpenWire and STOMP transport CVE priority coverage
- Java deserialization and JMX exposure hardening
- Maven / Docker / tarball delivery
- Signed artifacts (GPG)
- Artemis migration assessment
- 24/7 managed operations
OSSeva Assure
Patch plus broker audit and a costed path to Artemis or RabbitMQ.
- Everything in Patch
- Transport connector and authentication audit
- KahaDB and LevelDB store integrity review
- Network-of-brokers topology review
- SOC 2 / HIPAA attestation package
- Artemis or RabbitMQ migration assessment
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 broker monitoring, 15-min SLA, named JMS engineers.
- Everything in Assure
- 24/7 queue depth, store usage and connection monitoring
- 15-minute P1 incident response SLA
- Named senior ActiveMQ engineer
- Dead letter queue and redelivery policy management
- Migration execution to Artemis or RabbitMQ
- Quarterly capacity planning reviews
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Version is reported on startup and via JMX
activemq --version
# Or from a running broker over Jolokia
curl -s -u admin:admin \
http://localhost:8161/api/jolokia/read/\
org.apache.activemq:type=Broker,brokerName=localhost/BrokerVersion
# Anything below 5.19 receives no upstream security fixes.<dependency>
<groupId>io.osseva.activemq</groupId>
<artifactId>activemq-broker</artifactId>
<version>5.17.6-osseva-1</version>
</dependency>
<dependency>
<groupId>io.osseva.activemq</groupId>
<artifactId>activemq-client</artifactId>
<version>5.17.6-osseva-1</version>
</dependency>Migrate from Unsupported ActiveMQ Classic 5.x lines
OSSeva backports upstream security fixes onto the 5.x line you are running, so brokers stay on a version your integrations, selectors and store format already work with. When you are ready to leave Classic, the same engagement covers assessment and execution of the move to ActiveMQ Artemis or RabbitMQ.
Pricing model
OSSeva for ActiveMQ Classic is priced per broker cluster — not per queue, connection or message volume.
Frequently asked questions
Which versions of RabbitMQ are past community end-of-life?
RabbitMQ 3.8.x, 3.9.x, 3.10.x, 3.11.x, and 3.12.x have all reached community EOL — meaning no further security patches or CVE fixes are released by the RabbitMQ maintainers for those versions. RabbitMQ 3.13.x reached EOL in late 2024. OSSeva delivers backported CVE patches for 3.11 through 3.13.
Which PostgreSQL versions are no longer receiving community security patches?
PostgreSQL 9.6 through 13 have all reached community EOL. PostgreSQL 11 reached EOL November 2023, PostgreSQL 12 reached EOL November 2024, and PostgreSQL 13 reaches EOL November 2025. OSSeva provides extended security patching for PostgreSQL 11, 12, and 13 for teams that cannot immediately migrate to PG 14 or later.
Is Spring Framework 5.3.x still supported?
Spring Framework 5.3.x reached its community OSS EOL on December 31, 2024. Broadcom's commercial support for Spring 5.3.x is also no longer available under standard terms. OSSeva delivers backported CVE patches for Spring Framework 5.3.x and Spring Boot 2.7.x under our extended lifecycle support program.
Which versions of Apache Kafka are EOL?
Apache Kafka versions 2.x and 3.0 through 3.4 are past their community supported window, meaning no further patch releases. Kafka 3.5 and 3.6 have reached or are approaching EOL. OSSeva supports Kafka 2.8 through 3.5 with backported security patches and compliance documentation.
What happened to Redis licensing? Can I still use Redis for free?
In March 2024, Redis Ltd. changed the Redis license from BSD-3-Clause to the Business Source License (BSL 1.1), which restricts use in competing database products. The Valkey project (a Linux Foundation fork) continues under BSD-3-Clause. OSSeva maintains BSD-licensed, CVE-patched builds of Redis 6.2 and 7.0 for enterprises that need verifiable open-source licensing alongside security coverage.
Is Node.js 18 still receiving security patches?
Node.js 18 (LTS 'Hydrogen') reached its end-of-life date in April 2025 and no longer receives security releases from the Node.js project. OSSeva delivers CVE patches for Node.js 18 for enterprise teams that have not yet migrated to Node.js 20 or 22.
Is Apache Tomcat 8.5 still supported?
Apache Tomcat 8.5 reached its community EOL in March 2024. OSSeva provides extended security patching for Tomcat 8.5.x for teams running Java EE 7 workloads that cannot immediately migrate to Tomcat 9.0 or 10.1.
What .NET versions does OSSeva support?
.NET 6 reached Microsoft end-of-support in November 2024. .NET 7 reached EOL in May 2024. OSSeva delivers CVE patches for .NET 6 and .NET 7 for teams that have not yet migrated to .NET 8 (LTS, supported through November 2026).
Ready to get Apache ActiveMQ Classic patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.