{"id":"CVE-2026-50750","kind":"vulnerability","aliases":["CVE-2026-50750","GHSA-9qj4-v6r6-3wmx"],"related":[],"title":"Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability","description":"Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nFollowing the fix for  CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM.\nThis issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7, which fixes the issue.","summary":"Apache ActiveMQ brokers can be crashed by an unauthenticated client that repeatedly sends BrokerInfo commands without a ConnectionInfo, so the broker keeps allocating memory until it runs out. The result is a denial of service for every client that depends on the broker.","severity":"high","cvss":7.5,"epss":0.00686,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.activemq:activemq-broker","fixed":["5.19.8"],"affected":"= 5.19.7","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-broker","fixed":["6.2.7"],"affected":"= 6.2.6","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["5.19.8"],"affected":"= 5.19.7","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["6.2.7"],"affected":"= 6.2.6","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-all","fixed":["5.19.8"],"affected":"= 5.19.7","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-all","fixed":["6.2.7"],"affected":"= 6.2.6","ecosystem":"maven"},{"name":"apache activemq","fixed":[],"affected":"= 5.19.7","ecosystem":"vendor"},{"name":"apache activemq","fixed":[],"affected":"= 6.2.6","ecosystem":"vendor"},{"name":"apache activemq broker","fixed":[],"affected":"= 5.19.7","ecosystem":"vendor"},{"name":"apache activemq broker","fixed":[],"affected":"= 6.2.6","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["activemq","cwe-400","java","messaging","openwire","package"],"not_affected_if":["fixed-version","internal-only-broker"],"how_to_check":"- Check the ActiveMQ version in use, for example with `activemq-broker` or the version in the Maven dependency tree, and compare it with the affected ranges.\n- Confirm whether the broker's OpenWire transport is reachable from untrusted networks.","fix":"- Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: move from `5.19.7` to `5.19.8` on the 5.19 line.\n- Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: move from `6.2.6` to `6.2.7` on the 6.2 line.","status":"open","published_at":"2026-06-30T11:16:29+00:00","first_seen_at":"2026-11-04T16:08:53+00:00","triaged_at":"2026-11-04T16:09:48+00:00","updated_at":"2026-11-04T16:28:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T16:09:48Z","model":"claude-haiku-5-5","output":{"fix":"- Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: move from `5.19.7` to `5.19.8` on the 5.19 line.\n- Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: move from `6.2.6` to `6.2.7` on the 6.2 line.","reach":"network","title":"Apache ActiveMQ: unauthenticated BrokerInfo flood crashes broker with out-of-memory","impact":"medium","summary":"Apache ActiveMQ brokers can be crashed by an unauthenticated client that repeatedly sends BrokerInfo commands without a ConnectionInfo, so the broker keeps allocating memory until it runs out. The result is a denial of service for every client that depends on the broker.","audience":"developers","category":"package","nicknames":[],"who_cares":["activemq","java","messaging","openwire"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Broker crashes with out-of-memory, stopping message delivery for all clients.","analyst_note":"","how_to_check":"- Check the ActiveMQ version in use, for example with `activemq-broker` or the version in the Maven dependency tree, and compare it with the affected ranges.\n- Confirm whether the broker's OpenWire transport is reachable from untrusted networks.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","internal-only-broker"],"who_is_affected":"Teams running Apache ActiveMQ 5.19.7 or 6.2.6 that expose the broker to a network an untrusted client can reach. Deployments on versions before 5.19.7 are not listed as affected in the advisory, and brokers reachable only from trusted internal networks carry less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000805,"input_tokens":4676,"output_tokens":675,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A,28A,136C '-400':66B '-49270':137C '-50750':21A,29A '3wmx':26A '5.19.7':170C,180C,191C '5.19.8':172C,182C,193C '6.2.6':174C,184C,195C '6.2.7':176C,186C,197C,205C '9qj4':24A 'activemq':2A,5A,7A,32A,36A,41A,45A,48A,52A,55A,57A,59A,62A,64B,72B,124C,127C,129C,167C,178C,188C 'activemq-all':47A,51A 'activemq-broker':31A,35A 'affect':165C 'all':49A,53A 'alloc':93B 'apach':1A,4A,6A,71B,123C,126C,128C,166C,177C,187C 'apache':40A,44A,54A,56A,58A,61A 'apache-activemq':39A,43A 'attack':140C 'broker':3A,33A,37A,60A,63A,73B,91B,113B,125C,144C,158C,168C 'brokerinfo':84B,150C 'caus':143C 'client':80B,108B 'command':85B,151C 'connectioninfo':88B,155C 'crash':76B,160C 'cve':19A,27A,135C 'cwe':65B 'denial':11A,103B,114C 'depend':110B 'everi':107B 'fix':133C,207C 'follow':131C 'ghsa':23A 'ghsa-9qj4-v6r6-3wmx':22A 'issu':164C,209C 'java':67B 'keep':92B 'memori':17A,94B,120C 'messag':68B 'oom':145C,162C 'openwir':69B 'org.apache.activemq':30A,34A,38A,42A,46A,50A 'packag':70B 'recommend':200C 'repeat':82B,149C 'result':100B 'run':97B 'send':83B,147C,153C 'servic':13A,105B,116C 'unauthent':79B,139C 'upgrad':202C 'user':198C 'v6r6':25A 'version':204C 'via':14A,117C 'vulner':18A,121C 'without':86B,152C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache ActiveMQ 5.19.7 or 6.2.6 that expose the broker to a network an untrusted client can reach. Deployments on versions before 5.19.7 are not listed as affected in the advisory, and brokers reachable only from trusted internal networks carry less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["activemq","activemqbroker","apacheactivemq","apacheactivemqbroker","orgapacheactivemqactivemqall","orgapacheactivemqactivemqbroker","orgapacheactivemqapacheactivemq"],"ptokens":["activemq","all","apache","broker","org"],"labels":["activemq","cwe400","high","java","maven","messaging","openwire","package","vendor"],"campaign_type":null,"first_public_at":"2026-06-30T11:16:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9qj4-v6r6-3wmx","url":"https://github.com/advisories/GHSA-9qj4-v6r6-3wmx","severity":"high","published_at":"2026-06-30T12:31:52+00:00","modified_at":"2026-11-04T16:07:53+00:00","first_seen_at":"2026-11-04T16:08:53+00:00","fetched_at":"2026-11-04T16:13:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-50750","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50750","severity":null,"published_at":"2026-06-30T11:16:29+00:00","modified_at":"2026-07-02T18:42:47+00:00","first_seen_at":"2026-11-04T16:28:16+00:00","fetched_at":"2026-11-04T16:28:16+00:00","note":null}],"documents":[{"id":68254,"url":"https://github.com/apache/activemq/commit/80562ea8d327b7f538de1ff7672f158fe2abc4c1","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68252,"url":"https://github.com/apache/activemq/pull/2083","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68253,"url":"https://github.com/apache/activemq/commit/685ab0b7a4618abd25be7d64c3355401581b69e5","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68017,"url":"https://github.com/apache/activemq/releases/tag/activemq-6.2.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68255,"url":"https://github.com/apache/activemq/commit/f3a365e74e85dee6042f324156ace661e0d97f2d","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68016,"url":"https://github.com/apache/activemq/releases/tag/activemq-5.19.8","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68525,"url":"https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}