OSSEVA FOR ACTIVEMQ CLASSIC
ActiveMQ Classic support: patched 5.15 to 5.18 while you decide on Artemis
ActiveMQ Classic support from OSSeva keeps 5.15 to 5.18 patched after Apache stopped fixing them: Apache lists 5.18 and every earlier 5.x line as inactive, with fixes only on 5.19.x and 6.3.x. OSSeva's CVE directory holds 14 advisories published since the last 5.18 release in March 2025 that name 5.18.7. Send your work email and an engineer replies within 1 business day.
| Who it is for | Teams running ActiveMQ Classic 5.15, 5.16, 5.17 or 5.18 whose integrations are not ready for 5.19, 6.x or Artemis |
|---|---|
| What you get | Signed backports of Apache's security fixes onto your 5.x line, broker and client artifacts matched. Assure adds a broker audit, a costed path to Artemis or RabbitMQ and 24/7 reactive support. |
| How it is priced | Per broker cluster, not per queue, connection or message volume. Ask for a quote. |
| What happens next | You send your work email, we confirm your version and components, and you get a coverage plan. |
Reply within 1 business day · No commitment · or book a 15-minute call
Which vendors provide patched Apache ActiveMQ Classic after end of life? ActiveMQ 5.18 Extended Support and the Artemis Path.
Last reviewed
Trusted globally by enterprises
Which ActiveMQ Classic lines Apache still fixes, checked 20 October 2026
Status and last releases are from Apache's ActiveMQ Classic download page; end-of-life dates are from endoflife.date.
| Line | Apache status | Last release | End of life (endoflife.date) |
|---|---|---|---|
| 5.15 | Inactive | 5.15.16 | 9 Mar 2022 |
| 5.16 | Inactive | 5.16.8 | 18 Mar 2023 |
| 5.17 | Inactive | 5.17.7 | 12 Apr 2024 |
| 5.18 | Inactive | 5.18.7 (19 Mar 2025) | 11 Mar 2025 |
| 5.19 | Active | 5.19.11 (5 Sep 2026) | Supported |
| 6.0 | Inactive | 6.0.1 | 17 Mar 2024 |
| 6.1 | Inactive | 6.1.8 | 2 Dec 2025 |
| 6.2 | Inactive | 6.2.10 (26 Sep 2026) | Not yet dated |
| 6.3 | Active | 6.3.2 (2 Sep 2026) | Supported |
endoflife.date still shows 6.2 as supported; Apache's own page lists it as inactive, so treat Apache's status as the answer.
ActiveMQ end-of-life chart →ActiveMQ 5.18 end of life →ActiveMQ 5.17 end of life →
ActiveMQ vs Artemis: the support position
They are two brokers under one project name, so the choice is a migration decision. The support position is part of that decision.
| ActiveMQ Classic | ActiveMQ Artemis | |
|---|---|---|
| Lines Apache fixes today | 5.19.x and 6.3.x | 2.57 only |
| How older lines end | Marked inactive; 5.18 and earlier get no fixes | endoflife.date ends each minor when the next ships: 2.56 on 9 Sep 2026 |
| Persistence and protocol | KahaDB, with OpenWire at the centre | Its own journal, clustering model and configuration format |
| Moving between them | A migration, not an upgrade | A migration, not an upgrade |
Artemis dates are from endoflife.date, checked 20 October 2026. A destination broker that ends each minor within weeks of the next also needs an upgrade cadence.
ActiveMQ Classic vs Artemis in depth →Migrating Classic to Artemis →ActiveMQ Artemis support →
Advisories published since the last 5.18 release
Fourteen entries in OSSeva's CVE directory were published after 19 March 2025 and name 5.18.7. Each is fixed upstream only on 5.19.x or 6.x. CVE-2026-74761 also covers every 6.2.x release, which Apache now lists as inactive.
Show all 14 entries
| CVE | Published | CVSS | Affected range (NVD) | Fixed upstream in |
|---|---|---|---|---|
| CVE-2026-34197 | 2026-04-07 | 8.8 | <5.19.4; >=6.0.0 <6.2.3 | See advisory |
| CVE-2026-39304 | 2026-04-10 | 7.5 | before 5.19.4; 6.0.0 before 6.2.4 | 5.19.4 and 6.2.4 (the advisory recommends 5.19.5 or 6.2.4) |
| CVE-2026-40466 | 2026-04-24 | 8.8 | <5.19.6; >=6.0.0 <6.2.5 | See advisory |
| CVE-2026-41044 | 2026-04-24 | 8.8 | <5.19.6; >=6.0.0 <6.2.5 | See advisory |
| CVE-2026-42588 | 2026-06-01 | 8.1 | before 5.19.7; 6.0.0 before 6.2.6 | 5.19.7 and 6.2.6 |
| CVE-2026-45505 | 2026-06-01 | 8.8 | <5.19.7; >=6.0.0 <6.2.6 | See advisory |
| CVE-2026-49157 | 2026-06-01 | 8.8 | <5.19.7; >=6.0.0 <6.2.6 | See advisory |
| CVE-2026-49877 | 2026-06-30 | 8.1 | before 5.19.8; 6.0.0 before 6.2.7 | 5.19.8 and 6.2.7 |
| CVE-2026-49432 | 2026-06-30 | 7.5 | before 5.19.8; 6.0.0 before 6.2.7 | 5.19.8 and 6.2.7 |
| CVE-2026-50734 | 2026-06-30 | 7.5 | before 5.19.8; 6.0.0 before 6.2.7 | 5.19.8 and 6.2.7 |
| CVE-2026-53917 | 2026-06-30 | 7.5 | before 5.19.8; 6.0.0 before 6.2.7 | 5.19.8 and 6.2.7 |
| CVE-2026-54475 | 2026-06-30 | 7.5 | before 5.19.8; 6.0.0 before 6.2.7 | 5.19.8 and 6.2.7 |
| CVE-2026-59878 | 2026-07-28 | 7.5 | before 5.19.9; 6.0.0 before 6.2.8 | 5.19.9, 6.2.8 and 6.3.0 |
| CVE-2026-74761 | 2026-09-09 | 7.5 | before 5.19.11; 6.0.0 before 6.3.2 (includes every 6.2.x release) | 5.19.11 and 6.3.2 |
The 5.15, 5.16 and 5.17 lines are inside the same ranges. Confirm any entry at nvd.nist.gov.
Why now
Only the newest 5.x line receives fixes
Apache ActiveMQ Classic maintains the current 5.19.x series alongside 6.3.x; Apache lists 6.0, 6.1 and 6.2 as inactive. Releases continue steadily on those lines — 5.19.11 shipped on 5 September 2026 — but nothing is backported to 5.15, 5.16, 5.17 or 5.18. Those are the versions that shipped with a decade of enterprise integrations built on top of them.
CVE-2023-46604 proved how exposed this installed base is
The OpenWire unauthenticated remote code execution flaw was exploited in the wild by ransomware operators within days of disclosure. It affected every 5.x line below the patched releases. Organisations that could not upgrade on that timeline discovered exactly how little room a broker upgrade leaves you during an active incident.
The migration to Artemis is a rewrite, not an upgrade
ActiveMQ Artemis is a different broker with a different persistence engine, different clustering and different configuration. It is the right destination for most estates, but it is a project measured in quarters. Extended support on Classic is what makes that project a planned migration rather than an emergency one.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 5.15.x(No upstream fixes — OSSeva backported) | EOL | Clean |
| 5.16.x(No upstream fixes — OSSeva backported) | EOL | Clean |
| 5.17.x(No upstream fixes — OSSeva backported) | EOL | Clean |
| 5.18.x(No upstream fixes — OSSeva backported) | EOL | Clean |
| 5.19.x(Upstream maintained) | Current | Clean |
| 6.0–6.2.x(Apache lists as inactive — upgrade to 6.3.x) | EOL | Clean |
| 6.3.x(Upstream maintained) | Current | Clean |
Running a Apache ActiveMQ Classic version or build not listed here?
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
Backported CVE patches for ActiveMQ Classic 5.15–5.18.
- Security backports to your 5.x line, no version jump required
- OpenWire and STOMP transport CVE priority coverage
- Java deserialization and JMX exposure hardening
- Maven / Docker / tarball delivery
- Signed artifacts (GPG)
- Artemis migration assessment
- 24/7 managed operations
OSSeva Assure
Patch plus broker audit and a costed path to Artemis or RabbitMQ.
- Everything in Patch
- Transport connector and authentication audit
- KahaDB and LevelDB store integrity review
- Network-of-brokers topology review
- SOC 2 / HIPAA attestation package
- Artemis or RabbitMQ migration assessment
- 24/7 reactive support
OSSeva Operate
Full MSP: 24/7 broker monitoring, 15-min SLA, named JMS engineers.
- Everything in Assure
- 24/7 queue depth, store usage and connection monitoring
- 15-minute P1 incident response SLA
- Named senior ActiveMQ engineer
- Dead letter queue and redelivery policy management
- Migration execution to Artemis or RabbitMQ
- Quarterly capacity planning reviews
All tiers priced per cluster/application — not per core.
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Version is reported on startup and via JMX
activemq --version
# Or from a running broker over Jolokia
curl -s -u admin:admin \
http://localhost:8161/api/jolokia/read/\
org.apache.activemq:type=Broker,brokerName=localhost/BrokerVersion
# Anything below 5.19 receives no upstream security fixes.<dependency>
<groupId>io.osseva.activemq</groupId>
<artifactId>activemq-broker</artifactId>
<version>5.17.6-osseva-1</version>
</dependency>
<dependency>
<groupId>io.osseva.activemq</groupId>
<artifactId>activemq-client</artifactId>
<version>5.17.6-osseva-1</version>
</dependency>Migrate from Unsupported ActiveMQ Classic 5.x lines
OSSeva backports upstream security fixes onto the 5.x line you are running, so brokers stay on a version your integrations, selectors and store format already work with. When you are ready to leave Classic, the same engagement covers assessment and execution of the move to ActiveMQ Artemis or RabbitMQ.
Pricing model
OSSeva for ActiveMQ Classic is priced per broker cluster — not per queue, connection or message volume.
Is Apache ActiveMQ Classic 5.x end of life?
Not as a product line — the current 5.19.x series is actively maintained and released alongside 6.3.x. What is end of life is every older 5.x line. Apache does not backport security fixes to 5.15, 5.16, 5.17 or 5.18, so a broker on any of those receives nothing regardless of how many advisories are published against it.
What is the difference between ActiveMQ Classic and ActiveMQ Artemis?
They are two separate brokers under one project name. Classic is the original 5.x broker with KahaDB persistence and the OpenWire protocol at its centre. Artemis is a newer high-performance broker donated from HornetQ, with its own journal, its own clustering model and its own configuration format. Moving between them is a migration, not an upgrade — which is why OSSeva covers both.
Does OSSeva patch CVE-2023-46604?
Yes, and it is the clearest illustration of the gap this service exists to close. That OpenWire flaw allowed unauthenticated remote code execution and was exploited by ransomware groups within days of disclosure. OSSeva ships the fix backported onto 5.15 through 5.18 so brokers that cannot take a version jump are still protected.
Can we stay on ActiveMQ Classic indefinitely?
Under OSSeva coverage, yes — but we will not pretend that is the better long-term answer. Classic is in maintenance upstream and the ecosystem investment is going into Artemis. The honest recommendation for most estates is extended support now and a planned migration over the following twelve to eighteen months, with OSSeva carrying the security risk in the meantime.
Do you support the JMS client libraries as well as the broker?
Yes. The activemq-client artifact ships inside applications, not just on broker hosts, and deserialization advisories frequently land on the client side. OSSeva publishes patched client and broker artifacts from the same build so the versions on both ends of a connection stay matched.
Who provides ActiveMQ Classic support besides Apache?
The Apache ActiveMQ project maintains the 5.19.x and 6.3.x lines and ships fixes there. Other providers are commercial vendors that package ActiveMQ, cloud managed broker services and third-party support companies. OSSeva is a third-party option: one contract across your messaging and database stack, end-of-life 5.15 to 5.18 lines included, and backported builds that run wherever you run your brokers.
Does OSSeva support current ActiveMQ Classic versions or only end-of-life ones?
OSSeva's backported patches are built for the end-of-life 5.15, 5.16, 5.17 and 5.18 lines. OSSeva's support matrix lists 5.19.x and 6.3.x as current and upstream maintained, with 6.0 to 6.2.x inactive and a recommendation to upgrade to 6.3.x. Assure adds an Artemis or RabbitMQ migration assessment, and Operate includes migration execution.
How is OSSeva ActiveMQ Classic support priced?
OSSeva ActiveMQ Classic support is priced per broker cluster, not per queue, connection or message volume. Patch covers backported CVE patches, Assure adds 24/7 reactive support, a broker audit and a costed migration path, and Operate adds proactive 24/7 monitoring and managed operations with a 15-minute P1 SLA. OSSeva Operate patches Critical CVEs (CVSS ≥ 9.0) within 48 hours and High within 7 days. Book a discovery call for a quote.
Get a quote
Ready to get Apache ActiveMQ Classic patched and supported?
Tell us your Apache ActiveMQ Classic versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.
Prefer to talk or read more first?