Vulnerability-Lookup

CVE-2026-50750 (GCVE-0-2026-50750)

Vulnerability from cvelistv5 – Published: 2026-06-30 09:51 – Updated: 2026-06-30 13:21

Title

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270

Summary

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:21 UTC

CWE

Denial of Service via Out of Memory
CWE-400 - Uncontrolled Resource Consumption

Assigner

apache mitre root Scorecard

References

1 reference

URL	Tags
https://lists.apache.org/thread/nhkmbdym61yp6wwy0…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache ActiveMQ Broker	Affected: 5.19.7 , < 5.19.8 (semver) Affected: 6.2.6 , < 6.2.7 (semver)	guessed
Apache Software Foundation	Apache ActiveMQ	Affected: 5.19.7 , < 5.19.8 (semver) Affected: 6.2.6 , < 6.2.7 (semver)	guessed
Apache Software Foundation	Apache ActiveMQ All	Affected: 5.19.7 , < 5.19.8 (semver) Affected: 6.2.6 , < 6.2.7 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-50750",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:21:40.113842Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:21:45.456Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-broker",
          "product": "Apache ActiveMQ Broker",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.8",
              "status": "affected",
              "version": "5.19.7",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:apache-activemq",
          "product": "Apache ActiveMQ",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.8",
              "status": "affected",
              "version": "5.19.7",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-all",
          "product": "Apache ActiveMQ All",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.8",
              "status": "affected",
              "version": "5.19.7",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDenial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\u003c/p\u003eFollowing the fix for  CVE-2026-49270\u0026nbsp;an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending\u0026nbsp;a ConnectionInfo, until the broker will crash with OOM.\u003cbr\u003e\u003cp\u003eThis issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.2.7, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nFollowing the fix for  CVE-2026-49270\u00a0an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending\u00a0a ConnectionInfo, until the broker will crash with OOM.\nThis issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service via Out of Memory",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T09:51:57.035Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-50750",
    "datePublished": "2026-06-30T09:51:57.035Z",
    "dateReserved": "2026-06-06T19:20:20.134Z",
    "dateUpdated": "2026-06-30T13:21:45.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-50750",
      "date": "2026-10-01",
      "epss": "0.00686",
      "percentile": "0.50861"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.activemq:activemq-broker",
                "product": "Apache ActiveMQ Broker",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "5.19.8",
                    "status": "affected",
                    "version": "5.19.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2.7",
                    "status": "affected",
                    "version": "6.2.6",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.activemq:apache-activemq",
                "product": "Apache ActiveMQ",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "5.19.8",
                    "status": "affected",
                    "version": "5.19.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2.7",
                    "status": "affected",
                    "version": "6.2.6",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.activemq:activemq-all",
                "product": "Apache ActiveMQ All",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "5.19.8",
                    "status": "affected",
                    "version": "5.19.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2.7",
                    "status": "affected",
                    "version": "6.2.6",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache:activemq:5.19.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "30C93456-D814-415B-B251-C2B4F8D0824D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:activemq:6.2.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2AD1F411-C753-4C8D-8854-0641A1555544",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:activemq_broker:5.19.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9EE64253-BB81-4AFC-99B4-FA0F3F24CBFA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:activemq_broker:6.2.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "772DA95D-2A5D-4DC5-9FA6-2B23082702CB",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nFollowing the fix for  CVE-2026-49270\u00a0an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending\u00a0a ConnectionInfo, until the broker will crash with OOM.\nThis issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7, which fixes the issue."
          }
        ],
        "id": "CVE-2026-50750",
        "lastModified": "2026-07-02T18:42:47.253",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-50750",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:21:40.113842Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-30T11:16:29.933",
        "references": [
          {
            "source": "security@apache.org",
            "tags": [
              "Vendor Advisory",
              "Mailing List"
            ],
            "url": "https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-30T16:56:10+00:00",
      "cve": "CVE-2026-50750",
      "id": "CVE-2026-50750",
      "initial_release_date": "2026-06-30T09:51:57.035000+00:00",
      "product_status:known_not_affected": "121",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "activemq: Apache ActiveMQ: Denial of Service via repeated BrokerInfo commands",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50750.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.5,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-50750",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-30T13:21:40.113842Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-400",
                    "description": "CWE-400 Uncontrolled Resource Consumption",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-30T13:20:59.560Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.activemq:activemq-broker",
              "product": "Apache ActiveMQ Broker",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThan": "5.19.8",
                  "status": "affected",
                  "version": "5.19.7",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.2.7",
                  "status": "affected",
                  "version": "6.2.6",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.activemq:apache-activemq",
              "product": "Apache ActiveMQ",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThan": "5.19.8",
                  "status": "affected",
                  "version": "5.19.7",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.2.7",
                  "status": "affected",
                  "version": "6.2.6",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.activemq:activemq-all",
              "product": "Apache ActiveMQ All",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThan": "5.19.8",
                  "status": "affected",
                  "version": "5.19.7",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.2.7",
                  "status": "affected",
                  "version": "6.2.6",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eDenial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\u003c/p\u003eFollowing the fix for  CVE-2026-49270\u0026nbsp;an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending\u0026nbsp;a ConnectionInfo, until the broker will crash with OOM.\u003cbr\u003e\u003cp\u003eThis issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.2.7, which fixes the issue.\u003c/p\u003e"
                }
              ],
              "value": "Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nFollowing the fix for  CVE-2026-49270\u00a0an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending\u00a0a ConnectionInfo, until the broker will crash with OOM.\nThis issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7, which fixes the issue."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "text": "important"
                },
                "type": "Textual description of severity"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Denial of Service via Out of Memory",
                  "lang": "en"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-30T09:51:57.035Z",
            "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            "shortName": "apache"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "assignerShortName": "apache",
        "cveId": "CVE-2026-50750",
        "datePublished": "2026-06-30T09:51:57.035Z",
        "dateReserved": "2026-06-06T19:20:20.134Z",
        "dateUpdated": "2026-06-30T13:21:45.456Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-activemq-2026-50750

Vulnerability from bitnami_vulndb

Published

2026-07-06 05:47

Modified

2026-09-08 08:34

Summary

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270

Details

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.

Users are recommended to upgrade to version 6.2.7, which fixes the issue.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "activemq",
        "purl": "pkg:bitnami/activemq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.19.7"
            },
            {
              "fixed": "5.19.8"
            },
            {
              "introduced": "6.2.6"
            },
            {
              "fixed": "6.2.7"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50750"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
  },
  "details": "Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nFollowing the fix for  CVE-2026-49270\u00a0an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending\u00a0a ConnectionInfo, until the broker will crash with OOM.\nThis issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7, which fixes the issue.",
  "id": "BIT-activemq-2026-50750",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2026-07-06T05:47:14.523Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50750"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270"
}

FKIE_CVE-2026-50750

Vulnerability from fkie_nvd - Published: 2026-06-30 11:16 - Updated: 2026-07-02 18:42

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr	Vendor Advisory, Mailing List

Impacted products

Vendor	Product	Version
apache	activemq	5.19.7
apache	activemq	6.2.6
apache	activemq_broker	5.19.7
apache	activemq_broker	6.2.6

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-broker",
          "product": "Apache ActiveMQ Broker",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.8",
              "status": "affected",
              "version": "5.19.7",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:apache-activemq",
          "product": "Apache ActiveMQ",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.8",
              "status": "affected",
              "version": "5.19.7",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-all",
          "product": "Apache ActiveMQ All",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.8",
              "status": "affected",
              "version": "5.19.7",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.19.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "30C93456-D814-415B-B251-C2B4F8D0824D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:6.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "2AD1F411-C753-4C8D-8854-0641A1555544",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq_broker:5.19.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EE64253-BB81-4AFC-99B4-FA0F3F24CBFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq_broker:6.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "772DA95D-2A5D-4DC5-9FA6-2B23082702CB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nFollowing the fix for  CVE-2026-49270\u00a0an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending\u00a0a ConnectionInfo, until the broker will crash with OOM.\nThis issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7, which fixes the issue."
    }
  ],
  "id": "CVE-2026-50750",
  "lastModified": "2026-07-02T18:42:47.253",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-50750",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-30T13:21:40.113842Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-30T11:16:29.933",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Vendor Advisory",
        "Mailing List"
      ],
      "url": "https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-9QJ4-V6R6-3WMX

Vulnerability from github – Published: 2026-06-30 12:31 – Updated: 2026-06-30 15:30

Details

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-50750"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T11:16:29Z",
    "severity": "HIGH"
  },
  "details": "Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nFollowing the fix for  CVE-2026-49270\u00a0an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending\u00a0a ConnectionInfo, until the broker will crash with OOM.\nThis issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7, which fixes the issue.",
  "id": "GHSA-9qj4-v6r6-3wmx",
  "modified": "2026-06-30T15:30:44Z",
  "published": "2026-06-30T12:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50750"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

UBUNTU-CVE-2026-50750 (CVE-2026-50750)

Vulnerability from osv_ubuntu – Published: 2026-06-30 11:16 – Updated: 2026-07-01 21:26 – Source website

Details

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-50750	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-50750	REPORT
	https://lists.apache.org/thread/nhkmbdym61yp6wwy0…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.13.2+dfsg-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.13.2+dfsg-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.13.2+dfsg-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.6.0+dfsg1-4+deb8u1ubuntu1",
        "5.6.0+dfsg1-5",
        "5.13.2+dfsg-2",
        "5.13.2+dfsg-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.15.8-2~18.04.1~esm1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.15.8-2~18.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.15.8-2~18.04.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.14.5-3",
        "5.15.2-2",
        "5.15.3-2",
        "5.15.8-2~18.04",
        "5.15.8-2~18.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.15.11-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.15.11-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.15.11-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.15.10-1",
        "5.15.11-1",
        "5.15.11-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.16.1-1ubuntu0.1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.16.1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.16.1-1ubuntu0.1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.16.1-1",
        "5.16.1-1ubuntu0.1~esm1",
        "5.16.1-1ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.17.6+dfsg-1"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.17.6+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.17.6+dfsg-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.17.2+dfsg-2",
        "5.17.6+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.17.6+dfsg-2"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.17.6+dfsg-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.17.6+dfsg-2?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.17.6+dfsg-1",
        "5.17.6+dfsg-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "activemq",
            "binary_version": "5.17.6+dfsg-2"
          },
          {
            "binary_name": "libactivemq-java",
            "binary_version": "5.17.6+dfsg-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "activemq",
        "purl": "pkg:deb/ubuntu/activemq@5.17.6+dfsg-2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.17.6+dfsg-2"
      ]
    }
  ],
  "aliases": [],
  "details": "Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for  CVE-2026-49270\u00a0an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending\u00a0a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.",
  "id": "UBUNTU-CVE-2026-50750",
  "modified": "2026-07-01T21:26:34Z",
  "published": "2026-06-30T11:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-50750"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50750"
    },
    {
      "type": "REPORT",
      "url": "https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-50750"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-50750 (GCVE-0-2026-50750)

bit-activemq-2026-50750

Vulnerability from bitnami_vulndb

FKIE_CVE-2026-50750

GHSA-9QJ4-V6R6-3WMX

UBUNTU-CVE-2026-50750 (CVE-2026-50750)

Tags

Sightings

Nomenclature

Related by attack behaviour