---
id: "CVE-2026-50734"
kind: "vulnerability"
aliases: ["CVE-2026-50734", "GHSA-7259-vf48-52q3"]
title: "Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability"
severity: "high"
cvss: 7.5
epss: 0.0074
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.activemq:activemq-client", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "maven"}, {"name": "org.apache.activemq:activemq-client", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "maven"}, {"name": "org.apache.activemq:apache-activemq", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "maven"}, {"name": "org.apache.activemq:apache-activemq", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "maven"}, {"name": "org.apache.activemq:activemq-all", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "maven"}, {"name": "org.apache.activemq:activemq-all", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "maven"}, {"name": "apache activemq", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "vendor"}, {"name": "apache activemq", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["activemq", "cwe-789", "java", "message-broker", "openwire", "package", "self-hosted"]
not_affected_if: ["no-untrusted-network-access", "patched-version"]
published_at: "2026-06-30T11:16:29+00:00"
first_seen_at: "2026-11-04T16:03:42+00:00"
updated_at: "2026-11-04T16:28:16+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-7259-vf48-52q3", "first_seen_at": "2026-11-04T16:03:42+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50734", "first_seen_at": "2026-11-04T16:28:16+00:00"}]
---

# Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability

Apache ActiveMQ does not validate a size value in a WireFormatInfo frame, so the broker tries to allocate a huge amount of memory during pre-auth negotiation. An unauthenticated network attacker can exhaust memory and crash the broker, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.activemq:activemq-client affected < 5.19.8 fixed 5.19.8
- maven:org.apache.activemq:activemq-client affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- maven:org.apache.activemq:apache-activemq affected < 5.19.8 fixed 5.19.8
- maven:org.apache.activemq:apache-activemq affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- maven:org.apache.activemq:activemq-all affected < 5.19.8 fixed 5.19.8
- maven:org.apache.activemq:activemq-all affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- vendor:apache activemq affected < 5.19.8 fixed 5.19.8
- vendor:apache activemq affected >= 6.0.0, < 6.2.7 fixed 6.2.7

## How to check

- Check the ActiveMQ version or the Maven dependency version of `activemq-client`, `apache-activemq`, or `activemq-all`
- Versions `< 5.19.8` or `>= 6.0.0, < 6.2.7` are affected
- Confirm whether the broker's OpenWire transport is reachable from untrusted networks (default port 61616 is typical; unknown if the sources state a default)

## Fix

- Upgrade `activemq-client`, `apache-activemq`, and `activemq-all` to `5.19.8` on the 5.x line
- Upgrade to `6.2.7` on the 6.x line

## Timeline

- 2026-11-04T16:03:42+00:00 ghsa https://github.com/advisories/GHSA-7259-vf48-52q3
- 2026-11-04T16:28:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50734

## Documents

- [advisory] Vendor advisory: lists.apache.org https://lists.apache.org/thread/nxso951fnvf72qf9m475mpz4yf931xk0
- [advisory] Third-party advisory: www.openwall.com http://www.openwall.com/lists/oss-security/2026/06/29/10
- [fix] Patch: github.com https://github.com/apache/activemq/commit/6fc46e520bac7d9763ba5762cc2de603f19ed517
- [fix] Patch: github.com https://github.com/apache/activemq/commit/e25f9b88898ef7cdfac9e855f4559a1ad0a6da12
- [fix] Patch: github.com https://github.com/apache/activemq/pull/2080
- [fix] Release: github.com https://github.com/apache/activemq/releases/tag/activemq-6.2.7
- [fix] Release: github.com https://github.com/apache/activemq/releases/tag/activemq-5.19.8
- [fix] Patch: github.com https://github.com/apache/activemq/commit/42e2be75eddcece3cddacf8a73e6cad7db5aa626

## From the sources

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.

An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker.
This issue affects Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_