CVE-2014-3576: Apache ActiveMQ

High severity, CVSS 7.5. EPSS: 12.8% chance of exploitation in the next 30 days.

The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.

Affected products

• Apache ActiveMQ: up to and including 5.10.0
• Oracle Business Intelligence Publisher: version 12.2.1.0.0 only
• Oracle Fusion Middleware: version 8.1 only; version 9.0 only; version 11.1.1.7.4 only; version 12.1.3.0.0 only

Published 2015-08-14. Last modified 2026-06-17.