Description
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM.
This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.

Users are recommended to upgrade to version 6.2.7, which fixes the issue.
Published: 2026-06-30
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated attacker can trigger an Out of Memory condition in the broker by repeatedly sending BrokerInfo commands without first establishing a ConnectionInfo. This leads the broker to consume excessive memory and crash, resulting in a denial of service of the messaging service. The weakness is a form of resource exhaustion denial of service flaw.

Affected Systems

The flaw affects Apache ActiveMQ Broker, Apache ActiveMQ, and Apache ActiveMQ All. Vulnerable releases are 5.19.7 prior to 5.19.8 and 6.2.6 prior to 6.2.7.

Risk and Exploitability

Because no authentication is required, an attacker can cause the broker to consume excessive memory by repeatedly sending BrokerInfo commands without establishing a ConnectionInfo. The attack can be carried out from any host that can reach the broker's OpenWire port. EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector is sending crafted OpenWire packets over the network to trigger the memory exhaustion.

Generated by OpenCVE AI on July 1, 2026 at 12:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Apache ActiveMQ version 6.2.7 or later.
  • If an upgrade is not immediately possible, restrict OpenWire traffic to trusted hosts using firewall rules or access control lists.
  • Implement monitoring of broker memory usage and configure alerts to restart the broker when an OOM condition is detected.

Generated by OpenCVE AI on July 1, 2026 at 12:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache activemq
Apache activemq All
Apache activemq Broker
Vendors & Products Apache
Apache activemq
Apache activemq All
Apache activemq Broker

Wed, 01 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 30 Jun 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-768

Tue, 30 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 30 Jun 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-768

Tue, 30 Jun 2026 10:45:00 +0000

Type Values Removed Values Added
Description Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.
Title Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270
References

Subscriptions

Apache Activemq Activemq All Activemq Broker
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-06-30T13:21:45.456Z

Reserved: 2026-06-06T19:20:20.134Z

Link: CVE-2026-50750

cve-icon Vulnrichment

Updated: 2026-06-30T13:20:59.560Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-30T09:51:57Z

Links: CVE-2026-50750 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T12:45:16Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling