ORG.APACHE.ACTIVEMQ:ACTIVEMQ-CLIENT · CVE-2026-50734 · Package
FIX → 5.19.8 · 6.2.7
Apache ActiveMQ does not validate a size value in a WireFormatInfo frame, so the broker tries to allocate a huge amount of memory during pre-auth negotiation. An unauthenticated network attacker can exhaust memory and crash the broker, causing denial of service.
first public Jun 30, 2026 · 2 sources
Running Org.apache.activemq:activemq-client? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any team running an Apache ActiveMQ broker or embedding the ActiveMQ client or all-in-one jar in a version before 5.19.8 or in the 6.0.0 to 6.2.6 range. The broker accepts OpenWire connections before authentication, so exposure depends on whether its network port is reachable by untrusted clients. Deployments on patched versions or kept off untrusted networks can skip it.
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.
An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Not affected if no-untrusted-network-access, patched-version
Who cares activemq, cwe-789, java, message-broker, openwire, self-hosted
activemq-client, apache-activemq, or activemq-all< 5.19.8 or >= 6.0.0, < 6.2.7 are affectedUpgrade to 5.19.8 · 6.2.7
activemq-client, apache-activemq, and activemq-all to 5.19.8 on the 5.x line6.2.7 on the 6.x lineUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-50734") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.