Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability
GHSA-9qj4-v6r6-3wmx · BIT-activemq-2026-50750 · CVE-2026-50750
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM.
This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.
Users are recommended to upgrade to version 6.2.7, which fixes the issue.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-50750
- WEB https://github.com/apache/activemq/pull/2083
- WEB https://github.com/apache/activemq/commit/685ab0b7a4618abd25be7d64c3355401581b69e5
- WEB https://github.com/apache/activemq/commit/80562ea8d327b7f538de1ff7672f158fe2abc4c1
- WEB https://github.com/apache/activemq/commit/f3a365e74e85dee6042f324156ace661e0d97f2d
- PACKAGE https://github.com/apache/activemq
- WEB https://github.com/apache/activemq/releases/tag/activemq-5.19.8
- WEB https://github.com/apache/activemq/releases/tag/activemq-6.2.7
- WEB https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr
Ready to move
Start Securing
Free, no credit card | First findings in minutes