{"id":"CVE-2026-50734","kind":"vulnerability","aliases":["CVE-2026-50734","GHSA-7259-vf48-52q3"],"related":[],"title":"Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability","description":"Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.\n\nAn unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker.\nThis issue affects Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.","summary":"Apache ActiveMQ does not validate a size value in a WireFormatInfo frame, so the broker tries to allocate a huge amount of memory during pre-auth negotiation. An unauthenticated network attacker can exhaust memory and crash the broker, causing denial of service.","severity":"high","cvss":7.5,"epss":0.0074,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.activemq:activemq-client","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-client","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-all","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-all","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"apache activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"vendor"},{"name":"apache activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["activemq","cwe-789","java","message-broker","openwire","package","self-hosted"],"not_affected_if":["no-untrusted-network-access","patched-version"],"how_to_check":"- Check the ActiveMQ version or the Maven dependency version of `activemq-client`, `apache-activemq`, or `activemq-all`\n- Versions `< 5.19.8` or `>= 6.0.0, < 6.2.7` are affected\n- Confirm whether the broker's OpenWire transport is reachable from untrusted networks (default port 61616 is typical; unknown if the sources state a default)","fix":"- Upgrade `activemq-client`, `apache-activemq`, and `activemq-all` to `5.19.8` on the 5.x line\n- Upgrade to `6.2.7` on the 6.x line","status":"open","published_at":"2026-06-30T11:16:29+00:00","first_seen_at":"2026-11-04T16:03:42+00:00","triaged_at":"2026-11-04T16:05:42+00:00","updated_at":"2026-11-04T16:28:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T16:05:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `activemq-client`, `apache-activemq`, and `activemq-all` to `5.19.8` on the 5.x line\n- Upgrade to `6.2.7` on the 6.x line","reach":"network","title":"Apache ActiveMQ: crafted WireFormatInfo frame crashes broker before authentication","impact":"low","summary":"Apache ActiveMQ does not validate a size value in a WireFormatInfo frame, so the broker tries to allocate a huge amount of memory during pre-auth negotiation. An unauthenticated network attacker can exhaust memory and crash the broker, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["activemq","java","openwire","message-broker","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Broker crashes from memory exhaustion, causing denial of service","analyst_note":"","how_to_check":"- Check the ActiveMQ version or the Maven dependency version of `activemq-client`, `apache-activemq`, or `activemq-all`\n- Versions `< 5.19.8` or `>= 6.0.0, < 6.2.7` are affected\n- Confirm whether the broker's OpenWire transport is reachable from untrusted networks (default port 61616 is typical; unknown if the sources state a default)","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-untrusted-network-access"],"who_is_affected":"Any team running an Apache ActiveMQ broker or embedding the ActiveMQ client or all-in-one jar in a version before 5.19.8 or in the 6.0.0 to 6.2.6 range. The broker accepts OpenWire connections before authentication, so exposure depends on whether its network port is reachable by untrusted clients. Deployments on patched versions or kept off untrusted networks can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000814,"input_tokens":4634,"output_tokens":701,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,27A '-50734':20A,28A '-7259':22A '-789':59B '5.19.8':181C,189C,198C,212C '52q3':25A '6.0.0':183C,191C,200C '6.2.7':185C,193C,202C,210C 'activemq':2A,5A,7A,31A,35A,40A,44A,47A,51A,54A,56A,57B,70B,121C,124C,126C,178C,187C,195C 'activemq-all':46A,50A 'activemq-client':30A,34A 'affect':176C 'all':48A,52A 'alloc':12A,86B,113C,160C 'amount':89B 'apach':1A,4A,6A,69B,120C,123C,125C,177C,186C,194C 'apache':39A,43A,53A,55A 'apache-activemq':38A,42A 'attack':100B,131C 'attempt':159C 'auth':95B,164C 'broker':63B,83B,107B,135C,157C,173C 'caus':108B,133C,155C 'client':3A,32A,36A,122C,179C 'craft':140C 'crash':105B,171C 'cve':18A,26A 'cwe':58B 'denial':109B 'dos':136C 'excess':14A,115C 'exhaust':102B 'fix':214C 'frame':80B,142C 'ghsa':21A 'host':68B 'huge':88B 'issu':175C,216C 'java':60B 'larg':146C 'malici':145C 'memori':11A,91B,103B,112C 'messag':62B 'message-brok':61B 'negoti':96B,165C 'network':99B,130C 'oom':169C 'openwir':64B 'org.apache.activemq':29A,33A,37A,41A,45A,49A 'packag':65B 'pre':94B,163C 'pre-auth':93B,162C 'recommend':205C 'self':67B 'self-host':66B 'send':138C 'servic':111B 'size':15A,75B,116C,147C 'tri':84B 'trigger':168C 'unauthent':98B,129C 'upgrad':207C 'user':203C 'valid':73B,153C 'valu':16A,76B,117C,148C,150C 'version':209C 'vf48':24A 'vf48-52q3':23A 'vulner':17A,118C 'wireformatinfo':79B,141C","nicknames":[],"mitigations":[],"who_affected":"Any team running an Apache ActiveMQ broker or embedding the ActiveMQ client or all-in-one jar in a version before 5.19.8 or in the 6.0.0 to 6.2.6 range. The broker accepts OpenWire connections before authentication, so exposure depends on whether its network port is reachable by untrusted clients. Deployments on patched versions or kept off untrusted networks can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["activemq","apacheactivemq","orgapacheactivemqactivemqall","orgapacheactivemqactivemqclient","orgapacheactivemqapacheactivemq"],"ptokens":["activemq","all","apache","client","org"],"labels":["activemq","cwe789","high","java","maven","messagebroker","openwire","package","selfhosted","vendor"],"campaign_type":null,"first_public_at":"2026-06-30T11:16:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7259-vf48-52q3","url":"https://github.com/advisories/GHSA-7259-vf48-52q3","severity":"high","published_at":"2026-06-30T12:31:52+00:00","modified_at":"2026-11-04T15:59:58+00:00","first_seen_at":"2026-11-04T16:03:42+00:00","fetched_at":"2026-11-04T16:08:53+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-50734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50734","severity":null,"published_at":"2026-06-30T11:16:29+00:00","modified_at":"2026-07-02T18:40:36+00:00","first_seen_at":"2026-11-04T16:28:16+00:00","fetched_at":"2026-11-04T16:28:16+00:00","note":null}],"documents":[{"id":68239,"url":"https://github.com/apache/activemq/pull/2080","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68240,"url":"https://github.com/apache/activemq/commit/42e2be75eddcece3cddacf8a73e6cad7db5aa626","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68241,"url":"https://github.com/apache/activemq/commit/6fc46e520bac7d9763ba5762cc2de603f19ed517","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68242,"url":"https://github.com/apache/activemq/commit/e25f9b88898ef7cdfac9e855f4559a1ad0a6da12","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68016,"url":"https://github.com/apache/activemq/releases/tag/activemq-5.19.8","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68017,"url":"https://github.com/apache/activemq/releases/tag/activemq-6.2.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68526,"url":"https://lists.apache.org/thread/nxso951fnvf72qf9m475mpz4yf931xk0","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"},{"id":68527,"url":"http://www.openwall.com/lists/oss-security/2026/06/29/10","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}