CVE-2026-50734: Apache ActiveMQ Pre-Auth Memory Exhaustion DoS Vulnerability

Technical summary

The vulnerability exists in the WireFormatInfo frame processing during pre-authentication negotiation in Apache ActiveMQ. The affected code fails to validate the size value contained in a crafted WireFormatInfo frame, allowing an unauthenticated network attacker to specify an excessively large allocation size. When the broker attempts to allocate memory based on this unvalidated value, it triggers an out-of-memory (OOM) condition that crashes the broker process. The flaw is rooted in CWE-789 (Memory Allocation with Excessive Size Value) and is exploitable without prior authentication or user interaction.

Business impact

An attacker can render an ActiveMQ broker completely unavailable by crashing it. Since ActiveMQ is often central to message queuing, async processing, and enterprise integration, a successful attack disrupts all dependent applications and workflows. The impact extends beyond the broker itself—any application relying on message queuing experiences service degradation or failure. Recovery requires manual broker restart and potential investigation of what triggered the crash. For organizations running ActiveMQ in production, this creates both immediate availability risk and operational overhead.

Affected systems

Apache ActiveMQ versions before 5.19.8, and versions 6.0.0 through 6.2.6 are vulnerable. The issue affects the ActiveMQ broker itself, the ActiveMQ Client library, and the ActiveMQ All distribution. Any deployment running these versions on a network accessible to potential attackers is at risk, including cloud deployments and on-premises installations with network exposure.

Exploitability

This vulnerability is highly exploitable in practical scenarios. The attack requires only network connectivity to the ActiveMQ broker port—no authentication, no valid credentials, and no user interaction. The attacker simply sends a single malformed frame during the connection handshake. The simplicity of the attack vector combined with the immediate and severe impact (broker crash) makes this a significant risk. However, the vulnerability is not currently listed in the CISA KEV catalog, suggesting limited evidence of active, widespread exploitation in the wild at the time of publication.

Remediation

Upgrade to patched versions immediately: ActiveMQ 5.19.8 or later for the 5.x line, or ActiveMQ 6.2.7 or later for the 6.x line. Both releases include input validation for the WireFormatInfo frame size value. Verify the version upgrade was successful by checking the broker log and version output. If immediate patching is not possible, restrict network access to the ActiveMQ port using firewall rules or network segmentation to limit exposure to trusted clients only.

Patch guidance

Apply the vendor patch by upgrading to Apache ActiveMQ 5.19.8 (for 5.x deployments) or 6.2.7 (for 6.x deployments). Review the official Apache ActiveMQ release notes and security advisory to confirm the patch addresses this specific vulnerability before deploying to production. Test the upgrade in a non-production environment first to verify compatibility with your message producers and consumers. After patching, restart the broker and validate that existing message queues and connections work as expected.

Detection guidance

Monitor ActiveMQ broker logs for OOM errors or unexpected crashes during the pre-authentication phase. Network-level detection can identify repeated connection attempts with unusually large size values in WireFormatInfo frames, though this requires deep packet inspection of the OpenWire protocol. Alert on broker restarts or unexpected terminations, particularly if correlated with external network connections. Implement baseline monitoring of broker memory usage to detect anomalous allocation attempts before they trigger OOM.

Why prioritize this

This vulnerability scores HIGH (7.5 CVSS) due to the combination of network accessibility, lack of authentication requirements, and severe impact (complete broker denial of service). While not yet in active widespread exploitation according to KEV data, the attack is trivial to execute and requires minimal sophistication. Organizations should treat this as a priority patch—particularly those running ActiveMQ in internet-facing or multi-tenant environments where the attacker surface is larger.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: Attack Vector = Network (full Internet accessibility), Attack Complexity = Low (no special conditions needed), Privileges Required = None (unauthenticated attacker), User Interaction = None (no user action required), and Availability Impact = High (complete broker crash). The score correctly penalizes the ease of exploitation and total loss of service, while noting that confidentiality and integrity are not directly impacted by this particular flaw.

Frequently asked questions