GCVE - cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*

part: a version: 5.16.0 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Activemq (`db75e7d1-71e2-5c1b-8c68-2b326744850c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/activemq`	purl2cpe	2026-06-01 10:14:26.244612
`pkg:deb/debian/activemq`	purl2cpe	2026-06-01 10:14:26.244613
`pkg:deb/ubuntu/activemq`	purl2cpe	2026-06-01 10:14:26.244615
`pkg:dokcer/pharmazon/activemq_artemis`	purl2cpe	2026-06-01 10:14:26.244616
`pkg:github/apache/activemq`	purl2cpe	2026-06-01 10:14:26.244617
`pkg:maven/org.apache.activemq/activemq`	purl2cpe	2026-06-01 10:14:26.244619
`pkg:maven/org.apache.activemq/activemq-core`	purl2cpe	2026-06-01 10:14:26.244620

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-21351`	vulnerable	2026-06-08 05:29:11.729506	XStream is vulnerable to an Arbitrary Code Execution attack MEDIUM (5.4) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:15.000Z Updated: 2024-08-03T18:09:15.774Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c https://x-stream.github.io/CVE-2021-21351.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21350`	vulnerable	2026-06-08 05:29:11.727846	XStream is vulnerable to an Arbitrary Code Execution attack MEDIUM (5.3) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:20.000Z Updated: 2024-08-03T18:09:15.914Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq https://x-stream.github.io/CVE-2021-21350.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21349`	vulnerable	2026-06-08 05:29:11.726110	A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host MEDIUM (6.1) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:24.000Z Updated: 2024-08-03T18:09:15.735Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv https://x-stream.github.io/CVE-2021-21349.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21348`	vulnerable	2026-06-08 05:29:11.714277	XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) MEDIUM (5.3) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:29.000Z Updated: 2024-08-03T18:09:15.691Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq https://x-stream.github.io/CVE-2021-21348.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21347`	vulnerable	2026-06-08 05:29:11.712426	XStream is vulnerable to an Arbitrary Code Execution attack MEDIUM (6.1) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:40:13.000Z Updated: 2024-08-03T18:09:15.686Z Open on db.gcve.eu Reference links https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://x-stream.github.io/CVE-2021-21347.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21346`	vulnerable	2026-06-08 05:29:11.702902	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21345`	vulnerable	2026-06-08 05:29:11.695911	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21344`	vulnerable	2026-06-08 05:29:11.689283	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21343`	vulnerable	2026-06-08 05:29:11.678433	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21342`	vulnerable	2026-06-08 05:29:11.676887	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21341`	vulnerable	2026-06-08 05:29:11.667911	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-26217`	vulnerable	2026-06-08 05:23:50.891753	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.