CVE-2026-50750: Apache ActiveMQ Unauthenticated Denial of Service (OOM)

Technical summary

CVE-2026-50750 is a resource exhaustion vulnerability in Apache ActiveMQ's broker communication protocol. The vulnerability occurs when an attacker sends repeated BrokerInfo protocol messages without first completing a ConnectionInfo exchange, which should normally precede broker communication. The broker fails to properly limit or validate these unauthenticated messages, causing unbounded memory accumulation that leads to out-of-memory (OOM) conditions and process termination. This regressed following the remediation of CVE-2026-49270, indicating the earlier fix may not have fully addressed the underlying state-management logic. The flaw is classified under CWE-400 (Uncontrolled Resource Consumption).

Business impact

An attacker on the network can render your message broker completely unavailable without authentication or special privileges. For organizations relying on ActiveMQ for critical messaging infrastructure—order processing, event streaming, or inter-service communication—this vulnerability creates a simple and highly effective denial-of-service vector. Downtime could disrupt dependent applications, cause message loss or delays, and trigger cascading failures across the application stack. The unauthenticated nature of the attack makes mitigation through access controls alone insufficient.

Affected systems

Apache ActiveMQ versions 5.19.7 through 5.19.7, and 6.2.6 through 6.2.6 are vulnerable. The fix is available in Apache ActiveMQ 5.19.8 and 6.2.7. Organizations using ActiveMQ should immediately identify which versions are deployed. Earlier versions (pre-5.19.7 and pre-6.2.6) may not be affected by this specific regression, though they may be vulnerable to other known issues. Verify your exact version using the broker's management console or startup logs.

Exploitability

Exploitability is high due to minimal requirements: no authentication, no special network access beyond basic connectivity to the broker port, and no user interaction. An attacker needs only the ability to send arbitrary TCP/IP packets to the ActiveMQ broker. Crafting malicious BrokerInfo messages requires modest protocol knowledge but no sophisticated tools. The attack is repeatable and reliable, making it suitable for rapid exploitation once disclosure occurs. However, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog, so in-the-wild exploitation has not yet been confirmed.

Remediation

Upgrade to Apache ActiveMQ version 5.19.8 or 6.2.7 or later. Both patches restore proper state validation and request sequencing to prevent unauthenticated BrokerInfo injection. Patches should be applied without delay given the ease of exploitation. Organizations unable to patch immediately should implement network-level controls to restrict inbound traffic to the broker port (default 61616) to only trusted hosts or networks, though this is a temporary measure and not a substitute for patching.

Patch guidance

Apache ActiveMQ 5.19.8 and 6.2.7 contain the fixes for this vulnerability. Users on the 5.19.x line should upgrade to 5.19.8 or later; users on the 6.2.x line should upgrade to 6.2.7 or later. Plan upgrades during maintenance windows if necessary, but prioritize speed given the severity. Review release notes for any other fixes or changes in the target version. Test patches in a non-production environment first, particularly if custom configurations or integrations are in place. Verify the broker restarts cleanly and clients reconnect successfully after patching.

Detection guidance

Monitor broker memory usage for sudden spikes or rapid growth that correlates with incoming network traffic. Enable debug logging for the OpenWire protocol handler if available to identify malformed or unexpected BrokerInfo messages arriving without prior ConnectionInfo setup. Network intrusion detection systems can flag repeated BrokerInfo messages from the same source IP. Review broker logs for connection state errors or protocol violations. If the broker crashes with an OutOfMemoryError in recent logs, this vulnerability may have been exploited; correlate the timestamp with network access logs to identify the source.

Why prioritize this

This vulnerability warrants immediate attention due to its HIGH CVSS score (7.5), complete lack of authentication requirements, and direct impact on availability. The unauthenticated denial-of-service attack is trivial to execute and can be launched by any network attacker. Organizations running ActiveMQ in customer-facing or critical operational roles face unacceptable risk. The regression nature of the flaw also underscores the importance of thorough regression testing in vendor patches, raising confidence that upgrading will not introduce new instability.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the attack vector being network-accessible (AV:N), requiring no special privileges (PR:N) or user interaction (UI:N), with low attack complexity (AC:L), causing high impact to availability (A:H) while preserving confidentiality and integrity. The score appropriately captures the ease and severity of the attack. Given the lack of current KEV listing, the actual attack surface may be somewhat limited by network topology in practice, but organizations with internet-facing or untrusted-network-exposed brokers face the full score's consequences.

Frequently asked questions