GHSA-9qj4-v6r6-3wmxHighCVSS 7.5
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability
🔗 CVE IDs covered (1)
📋 Description
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.
Users are recommended to upgrade to version 6.2.7, which fixes the issue.
🎯 Affected products6
- maven/org.apache.activemq:activemq-broker:= 5.19.7
- maven/org.apache.activemq:activemq-broker:= 6.2.6
- maven/org.apache.activemq:apache-activemq:= 5.19.7
- maven/org.apache.activemq:apache-activemq:= 6.2.6
- maven/org.apache.activemq:activemq-all:= 5.19.7
- maven/org.apache.activemq:activemq-all:= 6.2.6
🔗 References (9)
- https://nvd.nist.gov/vuln/detail/CVE-2026-50750
- https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr
- https://github.com/apache/activemq/pull/2083
- https://github.com/apache/activemq/commit/685ab0b7a4618abd25be7d64c3355401581b69e5
- https://github.com/apache/activemq/commit/80562ea8d327b7f538de1ff7672f158fe2abc4c1
- https://github.com/apache/activemq/commit/f3a365e74e85dee6042f324156ace661e0d97f2d
- https://github.com/apache/activemq/releases/tag/activemq-5.19.8
- https://github.com/apache/activemq/releases/tag/activemq-6.2.7
- https://github.com/advisories/GHSA-9qj4-v6r6-3wmx