Apache: 18 Vulnerabilities Across ActiveMQ, Tomcat, Thrift Disclosed Together
A coordinated disclosure on July 29, 2026, revealed 18 vulnerabilities in Apache ActiveMQ, Tomcat, and Thrift, with a focus on DoS and information disclosure flaws in Thrift.
Key findings
- 18 vulnerabilities disclosed across Apache ActiveMQ, Tomcat, and Thrift between July 27-29, 2026.
- Multiple Denial-of-Service and Information Disclosure flaws impact various Apache Thrift bindings.
- Improper Authorization and Input Validation issues affect Apache ActiveMQ.
- Uncontrolled Resource Consumption vulnerability found in Apache Tomcat's WebSocket example.
- Apache Thrift users are recommended to upgrade to version 0.24.0.
On July 29, 2026, a significant batch of 18 vulnerabilities was disclosed across multiple Apache projects, including ActiveMQ, Tomcat, and Thrift. The vulnerabilities, disclosed between July 27 and July 29, span a range of severity, with several critical denial-of-service (DoS) and information disclosure flaws impacting Apache Thrift. This coordinated disclosure highlights potential risks for applications relying on these widely-used Apache frameworks for inter-process communication and web services.
The majority of the disclosed vulnerabilities, 11 in total, affect Apache Thrift. These include several denial-of-service (DoS) vulnerabilities, such as integer overflows (CVE-2026-55969, CVE-2026-55970), improper handling of compressed data (CVE-2026-49158, CVE-2026-48586), resource allocation issues (CVE-2026-45112, CVE-2026-58389), and data amplification (CVE-2026-41608). Information disclosure and denial-of-service due to out-of-bounds reads were also reported (CVE-2026-58023, CVE-2026-55970). Additionally, improper validation of certificates with host mismatch vulnerabilities were found in various bindings (CVE-2026-48145, CVE-2026-48144, CVE-2026-66053, CVE-2026-66053). Several of these Thrift vulnerabilities were rated as important with a CVSSv3 score of 7.5.
Beyond Thrift, Apache ActiveMQ experienced two vulnerabilities. CVE-2026-61487 is an improper authorization vulnerability that allows an authenticated low-privilege user to bypass per-destination write ACLs by sending messages to a temporary composite destination. CVE-2026-59878 is an improper input validation vulnerability in the AMQP connector that can lead to denial-of-service by sending a crafted frame size value, causing NIO threads to die.
Apache Tomcat's WebSocket component is affected by CVE-2026-66299, an uncontrolled resource consumption vulnerability in its chat example. This issue impacts specific versions of Tomcat 11, 10, and 9. Users who have followed security guidance to remove the examples web application are not affected.
The Apache Thrift vulnerabilities, primarily impacting denial-of-service and information disclosure, were disclosed between July 27-28, 2026. Multiple DoS vulnerabilities affect Python, C++, Node.js, and Ruby bindings, with CVSS scores ranging from moderate (6.5) to important (7.5).
Users of Apache ActiveMQ, Tomcat, and Thrift are strongly recommended to upgrade to the patched versions. For Apache Thrift, version 0.24.0 is recommended to address the vulnerabilities. Specific version information for ActiveMQ and Tomcat is not detailed in the advisories but users should consult the respective project security pages for guidance. Prompt patching is crucial to mitigate the risks associated with these disclosed flaws.
This batch of vulnerabilities underscores the importance of maintaining up-to-date software across the Apache ecosystem. Users should prioritize applying patches and reviewing their configurations to ensure they are protected against these newly disclosed security weaknesses. Staying informed about coordinated disclosure events and promptly addressing vulnerabilities is key to maintaining a secure environment.