Security for HYTE and
Apache ActiveMQ
HYTE publishes security bulletins for HYTE MQ and Apache ActiveMQ, with affected versions, fixed versions, and the steps HYTE recommends. Each bulletin states whether HYTE MQ is impacted. The Trust Center covers the other side: how HYTE secures its own company.
HYTE MQ and Apache ActiveMQ bulletins
Apache ActiveMQ NMS AMQP Client: deserialization of untrusted data
Updated October 20, 2025 · AMQP protocol only, not OpenWire
A malicious AMQP server can exploit unbounded deserialization in the .NET NMS AMQP client to run code on the client side. The allow and deny list protection introduced in 2.1.0 can be bypassed under some conditions.
- Affected
- Apache ActiveMQ NMS AMQP up to and including 2.3.0
- Fixed
- NMS AMQP 2.4.0 or later
- HYTE MQ impact
- Does not impact any currently supported HYTE product
Jolokia and REST API not secured in the default configuration
Updated May 2, 2024 · Tracked as AMQ-9477
In Apache ActiveMQ 6.x the default configuration leaves the API web context open, so the Jolokia JMX REST API and the Message REST API accept requests without authentication.
- Affected
- Apache ActiveMQ 6.x before 6.1.2
- Fixed
- Apache ActiveMQ 6.1.2 or greater, or the conf/jetty.xml change in the bulletin
- HYTE MQ impact
- Not impacted. HYTE MQ does not deploy the open source REST API
Unbounded deserialization in OpenWire allows remote code execution
Updated November 8, 2023 · Tracked as AMQ-9370
A remote attacker with network access to a broker can run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol. The bulletin includes upgrade steps and interim network controls.
- Affected
- Apache ActiveMQ 5.18.0 to 5.18.2, 5.17.0 to 5.17.5, 5.16.0 to 5.16.6, and before 5.15.16, plus the matching Legacy OpenWire modules
- Fixed
- Apache ActiveMQ 5.18.3, 5.17.6, 5.16.7, 5.15.16
- HYTE MQ impact
- Upgrade to HYTE MQ 5.4.102 or higher, or HYTE MQ OSS 4.3.7.hyte-4307h
Log4j Log4Shell vulnerability
Updated December 14, 2021 · PDF bulletin
A zero-day in the Log4j 2 logging framework allowed remote code execution through JNDI lookups. The bulletin gives a mitigation matrix by Log4j version and by HYTE product version, with three mitigation options and the options HYTE tested and does not recommend.
- Affected
- HYTE products on the HYTE Runtime (HYTE MQ, HYTE Console) using Log4j 2 before 2.16.0
- Fixed
- Mitigation flag on by default from HYTE Platform 5.2.28; permanent patch from HYTE Platform 5.4.x
- Apache ActiveMQ impact
- Apache ActiveMQ 5.x not vulnerable (uses Log4j 1.x); 5.17.0 and later patched to Log4j 2.16.0 upstream
Official Apache ActiveMQ security advisories
The Apache ActiveMQ project keeps the complete list of fixed vulnerabilities for every 6.x and 5.x release, with a link to each announcement. HYTE bulletins add the HYTE MQ assessment and mitigation detail for the advisories that matter most to HYTE customers.
HYTE works the fix, then tells you what it means
HYTE engineers commit code upstream to Apache ActiveMQ. When a vulnerability is reported, they help the community build the fix and contribute it back to the project, so the patched release customers run includes HYTE's work. HYTE then tests that release against HYTE MQ and publishes the bulletin.
Apache, ActiveMQ, and Apache ActiveMQ are trademarks of The Apache Software Foundation. HYTE is an independent contributor, not affiliated with or endorsed by the ASF.
Help build the fix upstream
HYTE engineers work with the Apache ActiveMQ community on the patch and contribute it back to the project. The fix lands in the official release, not in a private fork.
Test the fix against HYTE MQ
HYTE checks the vulnerability and the fix against the HYTE MQ release line and states the result: whether HYTE MQ is affected and which release resolves it. Where HYTE MQ ships a different component than the open source default, the bulletin says so.
Publish the bulletin
The bulletin gives affected versions, fixed versions, mitigation steps, and references, with a change log as HYTE learns more. HYTE Portal customers get the notice through their support channel.
HYTE's security posture as a company
The bulletins above answer questions about the software you run. The Trust Center answers the other question customers ask: how HYTE Technologies handles its own data, access, and risk. It is where a security team reviews HYTE's policies and controls during a vendor assessment, before an engagement and throughout it.
HYTE builds the Trust Center from its ISO 27001 program, so the documents it holds are the same ones the certification audit tests.
What the Trust Center holds
A single place for the documentation a vendor review asks for, kept current as HYTE's security program develops.
- Security policies and control descriptions
- Information for vendor risk and due diligence reviews
- Status of HYTE's ISO 27001 certification program
- How to request documents under NDA
Frequently Asked Questions
Where do I find security bulletins for HYTE MQ and Apache ActiveMQ?
HYTE publishes security bulletins for HYTE MQ and Apache ActiveMQ at hyte.io/security. Each bulletin names the affected versions, the fixed versions, and whether HYTE MQ is impacted, and links to the CVE record, the NIST entry, and the Apache advisory.
Is HYTE MQ affected by CVE-2024-32114?
No. CVE-2024-32114 affects the Jolokia and Message REST APIs in the default configuration of Apache ActiveMQ 6.x before 6.1.2. HYTE MQ does not deploy the open source REST API, so HYTE MQ customers are not impacted. Apache ActiveMQ users should upgrade to 6.1.2 or later or apply the jetty.xml change in the bulletin.
Which HYTE MQ version resolves CVE-2023-46604?
HYTE MQ 5.4.102 or higher resolves CVE-2023-46604, as does HYTE MQ OSS 4.3.7.hyte-4307h. Apache ActiveMQ users should upgrade to 5.18.3, 5.17.6, 5.16.7, or 5.15.16. The bulletin includes step-by-step upgrade instructions and interim network controls for environments that cannot upgrade at once.
What is the HYTE Trust Center?
The HYTE Trust Center is a page where customers and prospects review HYTE Technologies' security posture as a company, including policies, controls, and supporting documentation for vendor assessments. HYTE builds it from its ISO 27001 certification program, and it lives at hyte.io/trust.
How do I report a security issue to HYTE?
Customers report security issues by opening a support ticket in the HYTE Portal. Anyone else can reach HYTE through the contact page at hyte.io/contact. Issues in Apache ActiveMQ itself should also be reported to the Apache Software Foundation security team, since the fix lands upstream first.
Technical assistance
For technical assistance, open a support ticket in the HYTE Portal.
You are solely responsible for determining the appropriateness of using and distributing any publicly available HYTE information and you assume all risks associated with its use, including but not limited to the risks and costs of program errors, compliance with applicable laws, damage to or loss of data, programs or equipment, and the unavailability or interruption of operation. This information is not intended to be used in any situation where a failure could cause risk of injury or damage to property. This is not intended as legal advice and no warranty is provided with this information. Use at your own risk.
Talk with a messaging platform architect
A short conversation settles which bulletins apply to your environment and what your security team needs from HYTE.
Apache ActiveMQ 6.3.0 swaps a synchronized method for a ReentrantLock and moves subscriber dispatch out from under it. JMH benchmarks against 6.2.8 show up to 68% more topic send throughput, and up to 93% with the broker virtual thread runner on JDK 25.
In short: Apache ActiveMQ rarely makes headlines, but after 20+ years it remains one of the most widely deployed open source message brokers in production. For enterprises it lowers total cost of ownership, avoids proprietary vendor lock-in through open standards (AMQP, MQTT, STOMP, OpenWire, REST, WebSockets), consolidates multiple messaging patterns onto one platform, and offers a low-risk path off costly IBM MQ licensing. Its late-2025 move to independent Apache governance makes it a safer long-term bet, not a riskier one.
Matt Pavlovich discussed the benefits of messaging gateways, emphasizing their role in reducing human touchpoints and simplifying application development. He highlighted the importance of centralizing applications across physical locations to handle network performance and availability issues. Pavlovich shared his experience with ActiveMQ, mentioning the upcoming 6.0 release with virtual thread support. He also discussed the shift from orchestration to choreography, the introduction of batch queues, and the need for stricter platform policies to improve developer experience. The discussion also covered the importance of security, cost-effective monitoring, and the potential for industry standardization to streamline messaging adoption.
Matt Pavlovich, in his final post on this series topic, discusses the migration of ActiveMQ to the Jakarta framework and outlines the challenges encountered during this process. It highlights the need to modernize the codebase, address technical debt, and upgrade frameworks like Jetty, Spring, and others to support Jakarta. The piece also emphasizes the introduction of transitional modules to support users during the migration, while noting the effort involved in ensuring backward compatibility and preparing ActiveMQ for future updates.
Rich Bowen and Matt Pavlovich discuss the evolution of ActiveMQ Classic, highlighting the transition from Java to Jakarta ecosystem and the release of ActiveMQ 6.0, which introduced Jakarta support and JMS 2.0. ActiveMQ 6.1 focuses on fixes and observability improvements, with 6.2 set to introduce a new configuration system and virtual threads
HYTE Readings: Explore our curated collection of must-read articles, handpicked to keep you at the forefront of the latest in technology and messaging trends from around the web.
Apache ActiveMQ, a mature and open-source message broker, supports a range of protocols including JMS, MQTT, STOMP, and AMPQ, with updates to JMS 3.1 and 2.0 in its latest versions. Offering multi-protocol and multi-language capabilities, along with scalable deployment options such as standalone, clustered, and primary failover brokers, ActiveMQ is designed for extensive adaptability and DevOps benefits in application development. Matt Pavlovich from HYTE Technologies, a key contributor to ActiveMQ, highlights its ease of integration testing within application code, ensuring reliable end-to-end messaging testing for app development teams.
HYTE Readings: Explore our curated collection of must-read articles, handpicked to keep you at the forefront of the latest in technology and messaging trends from around the web.
Digital transformation centers on swiftly adjusting business functions to match fluctuating market scenarios and prospects by rapidly integrating and modifying business applications. Event-driven architecture facilitates this by allowing organizational and system decoupling, utilizing events to announce data changes or actions, providing design and runtime operational resilience, complementing API architecture which excels in read, search, and query use-cases.
After more than 20 years as a cornerstone of enterprise messaging, Apache ActiveMQ is entering a new era of fully community-driven development. A late 2025 decision to split ActiveMQ and Artemis into separate Apache Top-Level Projects gives ActiveMQ the autonomy to evolve independently—free from corporate roadmaps and guided solely by the Apache Way. With support for industry-standard protocols like AMQP, MQTT, and WebSockets, ActiveMQ remains as relevant as ever for modern IoT, microservices, and event-driven architectures.