Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-30T09:53:03 Apache ActiveMQ Client: Apache ActiveMQ: Apache ActiveMQ All: Apache ActiveMQ: Denial of Service via crafted WireFormatInfo frame 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

A flaw was found in Apache ActiveMQ. An unauthenticated network attacker can exploit this vulnerability by sending a specially crafted WireFormatInfo frame with an excessively large size value. This unvalidated value causes the broker to attempt an oversized memory allocation during pre-authentication negotiation. Consequently, this can lead to an Out Of Memory (OOM) error, resulting in a Denial of Service (DoS) and crashing the broker.

A flaw was found in Apache ActiveMQ Classic's OpenWire protocol handling. An unauthenticated remote attacker can crash the broker by sending a crafted WireFormatInfo frame with a malicious oversized value during pre-authentication protocol negotiation, causing an Out of Memory condition. Red Hat AMQ Broker is based on Apache ActiveMQ Artemis, but its OpenWire protocol support delegates wire format negotiation to Classic ActiveMQ's activemq-client code, which is vulnerable to this attack on the OpenWire listener port. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat AMQ Broker 7 Affected activemq-artemis-native Red Hat AMQ Broker 7 Affected activemq-client Red Hat AMQ Broker 7 Affected activemq-openwire-legacy Red Hat AMQ Broker 7 Affected apache-artemis Red Hat AMQ Broker 7 Affected artemis-amqp-protocol Red Hat AMQ Broker 7 Affected artemis-boot Red Hat AMQ Broker 7 Affected artemis-cli Red Hat AMQ Broker 7 Affected artemis-commons Red Hat AMQ Broker 7 Affected artemis-console Red Hat AMQ Broker 7 Affected artemis-console-war Red Hat AMQ Broker 7 Affected artemis-core-client Red Hat AMQ Broker 7 Affected artemis-dto Red Hat AMQ Broker 7 Affected artemis-hornetq-protocol Red Hat AMQ Broker 7 Affected artemis-hqclient-protocol Red Hat AMQ Broker 7 Affected artemis-jdbc-store Red Hat AMQ Broker 7 Affected artemis-jms-client Red Hat AMQ Broker 7 Affected artemis-jms-server Red Hat AMQ Broker 7 Affected artemis-journal Red Hat AMQ Broker 7 Affected artemis-lockmanager-api Red Hat AMQ Broker 7 Affected artemis-lockmanager-ri Red Hat AMQ Broker 7 Affected artemis-mqtt-protocol Red Hat AMQ Broker 7 Affected artemis-openwire-protocol Red Hat AMQ Broker 7 Affected artemis-ra Red Hat AMQ Broker 7 Affected artemis-selector Red Hat AMQ Broker 7 Affected artemis-server Red Hat AMQ Broker 7 Affected artemis-service-extensions Red Hat AMQ Broker 7 Affected artemis-stomp-protocol Red Hat AMQ Broker 7 Affected artemis-web Red Hat AMQ Broker 7 Affected libartemis-native-linux-aarch64 Red Hat AMQ Broker 7 Affected libartemis-native-linux-i686 Red Hat AMQ Broker 7 Affected libartemis-native-linux-ppc64le Red Hat AMQ Broker 7 Affected libartemis-native-linux-s390x Red Hat AMQ Broker 7 Affected libartemis-native-linux-x86_64 Red Hat AMQ Clients Affected activemq-artemis-native Red Hat AMQ Clients Affected artemis-amqp-protocol Red Hat AMQ Clients Affected artemis-commons Red Hat AMQ Clients Affected artemis-core-client Red Hat AMQ Clients Affected artemis-jdbc-store Red Hat AMQ Clients Affected artemis-journal Red Hat AMQ Clients Affected artemis-lockmanager-api Red Hat AMQ Clients Affected artemis-selector Red Hat AMQ Clients Affected artemis-server Red Hat build of Apache Camel for Spring Boot 4 Affected activemq-artemis-native Red Hat build of Apache Camel for Spring Boot 4 Affected artemis-mqtt-protocol Red Hat build of Apache Camel for Spring Boot 4 Affected artemis-relocations-parent Red Hat build of Apache Camel for Spring Boot 4 Affected libartemis-native-linux-aarch64 Red Hat build of Apache Camel for Spring Boot 4 Affected libartemis-native-linux-i686 Red Hat build of Apache Camel for Spring Boot 4 Affected libartemis-native-linux-ppc64le Red Hat build of Apache Camel for Spring Boot 4 Affected libartemis-native-linux-s390x Red Hat build of Apache Camel for Spring Boot 4 Affected libartemis-native-linux-x86_64 Red Hat Data Grid 8 Not affected zipkin-sender-activemq-client Red Hat Enterprise Linux 8 Affected log4j:2/log4j Red Hat Fuse 7 Out of support scope activeio-core Red Hat Fuse 7 Out of support scope activemq-broker Red Hat Fuse 7 Out of support scope activemq-client Red Hat Fuse 7 Out of support scope activemq-console Red Hat Fuse 7 Out of support scope activemq-http Red Hat Fuse 7 Out of support scope activemq-jms-pool Red Hat Fuse 7 Out of support scope activemq-kahadb-store Red Hat Fuse 7 Out of support scope activemq-karaf Red Hat Fuse 7 Out of support scope activemq-log4j-appender Red Hat Fuse 7 Out of support scope activemq-mqtt Red Hat Fuse 7 Out of support scope activemq-openwire-legacy Red Hat Fuse 7 Out of support scope activemq-osgi Red Hat Fuse 7 Out of support scope activemq-pool Red Hat Fuse 7 Out of support scope activemq-protobuf Red Hat Fuse 7 Out of support scope activemq-spring Red Hat Fuse 7 Out of support scope activemq-stomp Red Hat JBoss Enterprise Application Platform 7 Not affected wildfly-messaging-activemq Red Hat JBoss Enterprise Application Platform 8 Not affected activemq-artemis-native Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-cli Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-commons Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-core-client Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-dto Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-hornetq-protocol Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-hqclient-protocol Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-jakarta-client Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-jakarta-ra Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-jakarta-server Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-jakarta-service-extensions Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-jdbc-store Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-journal Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-selector Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-server Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-wildfly-integration Red Hat JBoss Enterprise Application Platform 8 Not affected libartemis-native-linux-aarch64 Red Hat JBoss Enterprise Application Platform 8 Not affected libartemis-native-linux-i686 Red Hat JBoss Enterprise Application Platform 8 Not affected libartemis-native-linux-ppc64le Red Hat JBoss Enterprise Application Platform 8 Not affected libartemis-native-linux-s390x Red Hat JBoss Enterprise Application Platform 8 Not affected libartemis-native-linux-x86_64 Red Hat JBoss Enterprise Application Platform 8 Not affected wildfly-messaging-activemq-injection Red Hat JBoss Enterprise Application Platform 8 Not affected wildfly-messaging-activemq-subsystem Red Hat Satellite 6 Not affected candlepin Red Hat Satellite 6 Not affected satellite:el8/candlepin Red Hat Single Sign-On 7 Affected activemq-artemis-native Red Hat Single Sign-On 7 Affected artemis-cli Red Hat Single Sign-On 7 Affected artemis-commons Red Hat Single Sign-On 7 Affected artemis-core-client Red Hat Single Sign-On 7 Affected artemis-dto Red Hat Single Sign-On 7 Affected artemis-hornetq-protocol Red Hat Single Sign-On 7 Affected artemis-hqclient-protocol Red Hat Single Sign-On 7 Affected artemis-jdbc-store Red Hat Single Sign-On 7 Affected artemis-jms-client Red Hat Single Sign-On 7 Affected artemis-jms-server Red Hat Single Sign-On 7 Affected artemis-journal Red Hat Single Sign-On 7 Affected artemis-ra Red Hat Single Sign-On 7 Affected artemis-selector Red Hat Single Sign-On 7 Affected artemis-server Red Hat Single Sign-On 7 Affected artemis-service-extensions Red Hat Single Sign-On 7 Affected artemis-tools Red Hat Single Sign-On 7 Affected artemis-wildfly-integration Red Hat Single Sign-On 7 Affected libartemis-native-linux-i686 Red Hat Single Sign-On 7 Affected libartemis-native-linux-x86_64 Red Hat Single Sign-On 7 Affected wildfly-messaging-activemq https://www.cve.org/CVERecord?id=CVE-2026-50734 https://nvd.nist.gov/vuln/detail/CVE-2026-50734 https://lists.apache.org/thread/nxso951fnvf72qf9m475mpz4yf931xk0