CVE-2026-39304 — Vulnerability in...

HIGH

Apache ActiveMQ: Denial of Service via Out of Memory vulnerability

Published April 10, 2026Updated September 10, 2026Source: osv

Summary

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS. Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.

Advisory Timeline

First published April 10, 2026 (185 days ago).
Last revised September 10, 2026 — 153 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.apache.activemq:activemq-client to 5.19.4 or later

<!-- Update pom.xml dependency version to 5.19.4 for org.apache.activemq:activemq-client -->

Maven

Update org.apache.activemq:activemq-broker to 6.2.4 or later

<!-- Update pom.xml dependency version to 6.2.4 for org.apache.activemq:activemq-broker -->

Maven

Update org.apache.activemq:activemq-all to 6.2.4 or later

<!-- Update pom.xml dependency version to 6.2.4 for org.apache.activemq:activemq-all -->

Maven

Update org.apache.activemq:activemq-client to 6.2.4 or later

<!-- Update pom.xml dependency version to 6.2.4 for org.apache.activemq:activemq-client -->

Maven

Update org.apache.activemq:activemq-all to 5.19.4 or later

<!-- Update pom.xml dependency version to 5.19.4 for org.apache.activemq:activemq-all -->

Maven

Update org.apache.activemq:apache-activemq to 6.2.4 or later

<!-- Update pom.xml dependency version to 6.2.4 for org.apache.activemq:apache-activemq -->

Maven

Update org.apache.activemq:activemq-broker to 5.19.4 or later

<!-- Update pom.xml dependency version to 5.19.4 for org.apache.activemq:activemq-broker -->

Maven

Update org.apache.activemq:apache-activemq to 5.19.4 or later

<!-- Update pom.xml dependency version to 5.19.4 for org.apache.activemq:apache-activemq -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (8)

Affects 1 ecosystem: maven (4).

Package	Ecosystem	Affected	Fixed In
org.apache.activemq:activemq-client	maven	5.10.0, 5.10.1, 5.10.2, 5.11.0 (+69 more)	5.19.4
org.apache.activemq:activemq-broker	maven	6.0.0, 6.0.1, 6.1.0, 6.1.1 (+11 more)	6.2.4
org.apache.activemq:activemq-all	maven	6.0.0, 6.0.1, 6.1.0, 6.1.1 (+11 more)	6.2.4
org.apache.activemq:activemq-client	maven	6.0.0, 6.0.1, 6.1.0, 6.1.1 (+11 more)	6.2.4
org.apache.activemq:activemq-all	maven	4.1.2, 5.0.0, 5.1.0, 5.10.0 (+84 more)	5.19.4
org.apache.activemq:apache-activemq	maven	6.0.0, 6.0.1, 6.1.0, 6.1.1 (+11 more)	6.2.4
org.apache.activemq:activemq-broker	maven	5.10.0, 5.10.1, 5.10.2, 5.11.0 (+69 more)	5.19.4
org.apache.activemq:apache-activemq	maven	4.1.1, 4.1.2, 5.0.0, 5.1.0 (+85 more)	5.19.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-400
Uncontrolled Resource ConsumptionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2026-39304?: Apache ActiveMQ: Denial of Service via Out of Memory vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2026-39304?: CVE-2026-39304 affects org.apache.activemq:activemq-client, org.apache.activemq:activemq-broker and org.apache.activemq:activemq-all (and 1 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-39304 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-5568-6qcg-g7fx

BIT-activemq-2026-39304

Related CVEs

CVE-2014-3600
CRITICAL
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
CVE-2023-46604
CRITICAL
Apache ActiveMQ is vulnerable to Remote Code Execution
CVE-2015-5254
CRITICAL
Improper Input Validation in Apache ActiveMQ
CVE-2026-42588
HIGH
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
CVE-2026-41044
HIGH
Apache ActiveMQ Vulnerable to Code Injection
CVE-2026-34197
HIGH
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
CVE-2026-45505
HIGH
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
CVE-2026-40466
HIGH
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies