GCVE - cpe:2.3:a:apache:activemq:5.16.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:activemq:5.16.1:*:*:*:*:*:*:*

part: a version: 5.16.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Activemq (`db75e7d1-71e2-5c1b-8c68-2b326744850c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/activemq`	purl2cpe	2026-06-01 10:14:26.244621
`pkg:deb/debian/activemq`	purl2cpe	2026-06-01 10:14:26.244623
`pkg:deb/ubuntu/activemq`	purl2cpe	2026-06-01 10:14:26.244624
`pkg:dokcer/pharmazon/activemq_artemis`	purl2cpe	2026-06-01 10:14:26.244625
`pkg:github/apache/activemq`	purl2cpe	2026-06-01 10:14:26.244627
`pkg:maven/org.apache.activemq/activemq`	purl2cpe	2026-06-01 10:14:26.244628
`pkg:maven/org.apache.activemq/activemq-core`	purl2cpe	2026-06-01 10:14:26.244629

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-21351`	vulnerable	2026-06-08 05:29:11.729522	XStream is vulnerable to an Arbitrary Code Execution attack MEDIUM (5.4) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:15.000Z Updated: 2024-08-03T18:09:15.774Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c https://x-stream.github.io/CVE-2021-21351.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21350`	vulnerable	2026-06-08 05:29:11.727863	XStream is vulnerable to an Arbitrary Code Execution attack MEDIUM (5.3) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:20.000Z Updated: 2024-08-03T18:09:15.914Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq https://x-stream.github.io/CVE-2021-21350.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21349`	vulnerable	2026-06-08 05:29:11.726127	A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host MEDIUM (6.1) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:24.000Z Updated: 2024-08-03T18:09:15.735Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv https://x-stream.github.io/CVE-2021-21349.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21348`	vulnerable	2026-06-08 05:29:11.714293	XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) MEDIUM (5.3) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:29.000Z Updated: 2024-08-03T18:09:15.691Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq https://x-stream.github.io/CVE-2021-21348.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21347`	vulnerable	2026-06-08 05:29:11.712445	XStream is vulnerable to an Arbitrary Code Execution attack MEDIUM (6.1) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:40:13.000Z Updated: 2024-08-03T18:09:15.686Z Open on db.gcve.eu Reference links https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://x-stream.github.io/CVE-2021-21347.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21346`	vulnerable	2026-06-08 05:29:11.702918	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21345`	vulnerable	2026-06-08 05:29:11.695928	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21344`	vulnerable	2026-06-08 05:29:11.689300	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21343`	vulnerable	2026-06-08 05:29:11.678450	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21342`	vulnerable	2026-06-08 05:29:11.676904	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21341`	vulnerable	2026-06-08 05:29:11.668677	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.