CVE-2022-23913 Apache ActiveMQ Artemis DoS

What is CVE-2022-23913?

CVE-2022-23913 is a high-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 4 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

Weakness: CWE-770

Which versions are affected by CVE-2022-23913?

2 open source packages ship an affected version, including org.apache.activemq:artemis-core-client. It affects 3 products.

Products include Apache Artemis, Netapp Active Iq Unified Manager, Netapp Oncommand Workflow Automation.

How do I fix CVE-2022-23913?

Upgrade org.apache.activemq:artemis-core-client to 2.19.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-23913 being exploited?

There is no known exploitation of CVE-2022-23913 in the wild and no public exploit code.

Other vulnerabilities in Netapp Active Iq Unified Manager

• CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment Critical 9.8
• CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Critical 9.3
• CVE-2026-49364 Information disclosure in Apache ActiveMQ Artemis Critical 9.1
• CVE-2026-67593 Missing authorization in Apache ActiveMQ Artemis Critical 9.1
• CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans High 8.8

All Netapp Active Iq Unified Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pr38-qpxm-g88x.