Detections
Analytics

SCA: security update for org.apache.artemis:artemis-stomp-protocol (GHSA-rf99-f9j2-gv3f)

medium Tenable Cloud Security Plugin ID 446669

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security
 credentials that grant either the consume or send permission on an address can augment the routing-type
 supported by that address even if said user doesn't have the createAddress permission for that particular
 address. A user could successfully send a message to an address or consume a message from a queue with a
 routing-type not supported by the corresponding address when that operation should actually be rejected on
 the basis that the user doesn't have permission to change the routing-type of the address. Even though the
 user was already granted permission to send and/or consume messages, they should not be able to augment
 the routing-type of the address without the createAddress permission. This issue affects Apache Artemis:
 from 2.50.0 through 2.53.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to
 upgrade to version 2.54.0, which fixes the issue. (CVE-2026-40914)

Solution

Update the org.apache.artemis:artemis-stomp-protocol library and its related packages to version 2.54.0 or later.

See Also

https://github.com/advisories/GHSA-rf99-f9j2-gv3f

Plugin Details

Severity: Medium

ID: 446669

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/31/2026

Updated: 8/31/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2026-40914

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/28/2026

Vulnerability Publication Date: 5/28/2026

Reference Information

CVE: CVE-2026-40914

cwe: CWE-863