CVE-2026-32642
Apache Artemis: OpenWire non-durable subscription creates an address without createAddress
Technology
ActiveMQ Artemis
CVSS Score
4.3 / 10.0
Affected Versions
Apache Artemis 2.50.0 to 2.52.0; Apache ActiveMQ Artemis 2.0.0 to 2.44.0
Upstream Fix
2.53.0
Published
March 24, 2026
OSSeva Coverage
Fixed upstream
Description
When an authenticated OpenWire user with createDurableQueue but not createAddress permission creates a non-durable JMS topic subscription on an address that does not exist, with address auto-creation disabled, the broker creates a temporary address instead of rejecting the request. The address is removed when the connection closes. Apache rates it low.
Is your ActiveMQ Artemis deployment affected?
If you're running Apache Artemis 2.50.0 to 2.52.0; Apache ActiveMQ Artemis 2.0.0 to 2.44.0, you need this patch. Book a discovery call to get covered.