GHSA-9qj4-v6r6-3wmx

Dashboard / Vulnerabilities / GHSA-9qj4-v6r6-3wmx

GHSA-9qj4-v6r6-3wmx

Summary: Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability

Details: Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

References: https://nvd.nist.gov/vuln/detail/CVE-2026-50750, https://github.com/apache/activemq/pull/2083, https://github.com/apache/activemq/commit/685ab0b7a4618abd25be7d64c3355401581b69e5, https://github.com/apache/activemq/commit/80562ea8d327b7f538de1ff7672f158fe2abc4c1, https://github.com/apache/activemq/commit/f3a365e74e85dee6042f324156ace661e0d97f2d, https://github.com/apache/activemq, https://github.com/apache/activemq/releases/tag/activemq-5.19.8, https://github.com/apache/activemq/releases/tag/activemq-6.2.7, https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr