ORG.APACHE.ACTIVEMQ:ACTIVEMQ-BROKER · CVE-2026-50750 · Package
FIX → 5.19.8 · 6.2.7
Apache ActiveMQ brokers can be crashed by an unauthenticated client that repeatedly sends BrokerInfo commands without a ConnectionInfo, so the broker keeps allocating memory until it runs out. The result is a denial of service for every client that depends on the broker.
first public Jun 30, 2026 · 2 sources
Running Org.apache.activemq:activemq-broker? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams running Apache ActiveMQ 5.19.7 or 6.2.6 that expose the broker to a network an untrusted client can reach. Deployments on versions before 5.19.7 are not listed as affected in the advisory, and brokers reachable only from trusted internal networks carry less exposure.
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.
Not affected if fixed-version, internal-only-broker
Who cares activemq, cwe-400, java, messaging, openwire
activemq-broker or the version in the Maven dependency tree, and compare it with the affected ranges.Upgrade to 5.19.8 · 6.2.7
5.19.7 to 5.19.8 on the 5.19 line.6.2.6 to 6.2.7 on the 6.2 line.Users are recommended to upgrade to version 6.2.7, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-50750") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.