Fix CVEs (CVE-2026-42253, etc) (5.15.x)#217

Open

epearson-tt wants to merge 7 commits into

tomitribe:activemq-5.15.x-TT.xfrom

epearson-tt:activemq-5.15.x-TT.x-cve42253etal

Commits on Jun 12, 2026

CVE-2026-42588: Block the XBeanBrokerFactory by default inside VMTransportFactory (#2003) (#2011)

cshannon
authored and
Erik Pearson
committed
CVE-2026-42253: Disable the message servlet by default (#2000) (#2015)

cshannon
authored and
Erik Pearson
committed
CVE-2026-46605: [#2005] 5.19.x - Fix authorization check on removeDestination (#2008)

mattrpav
authored and
Erik Pearson
committed
CVE-2026-45505: Handle validation for Composite URIs without parens (#2004) (#2013)

cshannon
authored and
Erik Pearson
committed
CVE-2026-49157: [5.19.x] Harden web console and Jolokia access by default (#2025) (#2038)

jbonofre
authored and
Erik Pearson
committed
CVE-2026-49270: Ensure connection info is processed before durable sync (#2049)

cshannon
authored and
Erik Pearson
committed

Commits on Jun 16, 2026

Removed ackson-dataformat-xml duplication in pom.xml and fixed NoClassDefFoundError: com/fasterxml/jackson/databind/AnnotationIntrospector
cesarhernandezgt
committed