Internet-Security raven logo internet-security.com

TCP 61616

ProtocolTCP
Port61616
Labels

Synopsis

  • Apache ActiveMQ Classic uses TCP port 61616 by default for its native OpenWire messaging protocol (broker client connections).
  • Apache ActiveMQ Artemis (and derivatives like Red Hat AMQ) listens on 61616 by default and can multiplex OpenWire, AMQP, MQTT, and STOMP on that single port.
  • Amazon MQ (managed ActiveMQ) exposes non-TLS OpenWire endpoints on 61616 (with TLS typically on 61617).
  • Many Java applications and frameworks (e.g., Spring Boot using ActiveMQ) default to connecting to tcp://localhost:61616 for the broker.
  • Popular Docker images/distributions of ActiveMQ publish 61616 as the primary client/broker port (with 8161 often used for the web console).
  • Security: ActiveMQ has had notable exploits targeting this port, including CVE-2023-46604 (OpenWire deserialization RCE) used in the wild against brokers exposed on 61616.

Observed activity

Last 30 days Detailed chart

More information