Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-30T09:51:57 activemq: Apache ActiveMQ: Denial of Service via repeated BrokerInfo commands 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

A flaw was found in Apache ActiveMQ. An unauthenticated remote attacker can exploit this vulnerability by repeatedly sending BrokerInfo commands without corresponding ConnectionInfo commands. This can lead to an Out of Memory condition, causing the broker to crash and resulting in a Denial of Service.

Red Hat products that include Apache ActiveMQ classic components ship versions prior to 5.19.7 (5.x line) and prior to 6.2.6 (6.x line). The vulnerable code was introduced as a regression in versions 5.19.7 and 6.2.6 while fixing CVE-2026-49270, and is not present in the versions shipped by Red Hat. Products shipping Apache ActiveMQ Artemis are not affected as Artemis is a separate codebase. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat AMQ Broker 7 Not affected activemq-artemis-native Red Hat AMQ Broker 7 Not affected activemq-client Red Hat AMQ Broker 7 Not affected activemq-openwire-legacy Red Hat AMQ Broker 7 Not affected apache-artemis Red Hat AMQ Broker 7 Not affected artemis-amqp-protocol Red Hat AMQ Broker 7 Not affected artemis-boot Red Hat AMQ Broker 7 Not affected artemis-cli Red Hat AMQ Broker 7 Not affected artemis-commons Red Hat AMQ Broker 7 Not affected artemis-console Red Hat AMQ Broker 7 Not affected artemis-console-war Red Hat AMQ Broker 7 Not affected artemis-core-client Red Hat AMQ Broker 7 Not affected artemis-dto Red Hat AMQ Broker 7 Not affected artemis-hornetq-protocol Red Hat AMQ Broker 7 Not affected artemis-hqclient-protocol Red Hat AMQ Broker 7 Not affected artemis-jdbc-store Red Hat AMQ Broker 7 Not affected artemis-jms-client Red Hat AMQ Broker 7 Not affected artemis-jms-server Red Hat AMQ Broker 7 Not affected artemis-journal Red Hat AMQ Broker 7 Not affected artemis-lockmanager-api Red Hat AMQ Broker 7 Not affected artemis-lockmanager-ri Red Hat AMQ Broker 7 Not affected artemis-mqtt-protocol Red Hat AMQ Broker 7 Not affected artemis-openwire-protocol Red Hat AMQ Broker 7 Not affected artemis-ra Red Hat AMQ Broker 7 Not affected artemis-selector Red Hat AMQ Broker 7 Not affected artemis-server Red Hat AMQ Broker 7 Not affected artemis-service-extensions Red Hat AMQ Broker 7 Not affected artemis-stomp-protocol Red Hat AMQ Broker 7 Not affected artemis-web Red Hat AMQ Broker 7 Not affected libartemis-native-linux-aarch64 Red Hat AMQ Broker 7 Not affected libartemis-native-linux-i686 Red Hat AMQ Broker 7 Not affected libartemis-native-linux-ppc64le Red Hat AMQ Broker 7 Not affected libartemis-native-linux-s390x Red Hat AMQ Broker 7 Not affected libartemis-native-linux-x86_64 Red Hat AMQ Clients Not affected activemq-artemis-native Red Hat AMQ Clients Not affected artemis-amqp-protocol Red Hat AMQ Clients Not affected artemis-commons Red Hat AMQ Clients Not affected artemis-core-client Red Hat AMQ Clients Not affected artemis-jdbc-store Red Hat AMQ Clients Not affected artemis-journal Red Hat AMQ Clients Not affected artemis-lockmanager-api Red Hat AMQ Clients Not affected artemis-selector Red Hat AMQ Clients Not affected artemis-server Red Hat build of Apache Camel for Spring Boot 4 Not affected activemq-artemis-native Red Hat build of Apache Camel for Spring Boot 4 Not affected artemis-mqtt-protocol Red Hat build of Apache Camel for Spring Boot 4 Not affected artemis-relocations-parent Red Hat build of Apache Camel for Spring Boot 4 Not affected libartemis-native-linux-aarch64 Red Hat build of Apache Camel for Spring Boot 4 Not affected libartemis-native-linux-i686 Red Hat build of Apache Camel for Spring Boot 4 Not affected libartemis-native-linux-ppc64le Red Hat build of Apache Camel for Spring Boot 4 Not affected libartemis-native-linux-s390x Red Hat build of Apache Camel for Spring Boot 4 Not affected libartemis-native-linux-x86_64 Red Hat Data Grid 8 Not affected zipkin-sender-activemq-client Red Hat Enterprise Linux 8 Not affected log4j:2/log4j Red Hat Fuse 7 Not affected activeio-core Red Hat Fuse 7 Not affected activemq-broker Red Hat Fuse 7 Not affected activemq-client Red Hat Fuse 7 Not affected activemq-console Red Hat Fuse 7 Not affected activemq-http Red Hat Fuse 7 Not affected activemq-jms-pool Red Hat Fuse 7 Not affected activemq-kahadb-store Red Hat Fuse 7 Not affected activemq-karaf Red Hat Fuse 7 Not affected activemq-log4j-appender Red Hat Fuse 7 Not affected activemq-mqtt Red Hat Fuse 7 Not affected activemq-openwire-legacy Red Hat Fuse 7 Not affected activemq-osgi Red Hat Fuse 7 Not affected activemq-pool Red Hat Fuse 7 Not affected activemq-protobuf Red Hat Fuse 7 Not affected activemq-spring Red Hat Fuse 7 Not affected activemq-stomp Red Hat JBoss Enterprise Application Platform 7 Not affected wildfly-messaging-activemq Red Hat JBoss Enterprise Application Platform 8 Not affected activemq-artemis-native Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-cli Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-commons Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-core-client Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-dto Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-hornetq-protocol Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-hqclient-protocol Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-jakarta-client Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-jakarta-ra Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-jakarta-server Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-jakarta-service-extensions Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-jdbc-store Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-journal Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-selector Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-server Red Hat JBoss Enterprise Application Platform 8 Not affected artemis-wildfly-integration Red Hat JBoss Enterprise Application Platform 8 Not affected libartemis-native-linux-aarch64 Red Hat JBoss Enterprise Application Platform 8 Not affected libartemis-native-linux-i686 Red Hat JBoss Enterprise Application Platform 8 Not affected libartemis-native-linux-ppc64le Red Hat JBoss Enterprise Application Platform 8 Not affected libartemis-native-linux-s390x Red Hat JBoss Enterprise Application Platform 8 Not affected libartemis-native-linux-x86_64 Red Hat JBoss Enterprise Application Platform 8 Not affected wildfly-messaging-activemq-injection Red Hat JBoss Enterprise Application Platform 8 Not affected wildfly-messaging-activemq-subsystem Red Hat Satellite 6 Not affected candlepin Red Hat Satellite 6 Not affected satellite:el8/candlepin Red Hat Single Sign-On 7 Not affected activemq-artemis-native Red Hat Single Sign-On 7 Not affected artemis-cli Red Hat Single Sign-On 7 Not affected artemis-commons Red Hat Single Sign-On 7 Not affected artemis-core-client Red Hat Single Sign-On 7 Not affected artemis-dto Red Hat Single Sign-On 7 Not affected artemis-hornetq-protocol Red Hat Single Sign-On 7 Not affected artemis-hqclient-protocol Red Hat Single Sign-On 7 Not affected artemis-jdbc-store Red Hat Single Sign-On 7 Not affected artemis-jms-client Red Hat Single Sign-On 7 Not affected artemis-jms-server Red Hat Single Sign-On 7 Not affected artemis-journal Red Hat Single Sign-On 7 Not affected artemis-ra Red Hat Single Sign-On 7 Not affected artemis-selector Red Hat Single Sign-On 7 Not affected artemis-server Red Hat Single Sign-On 7 Not affected artemis-service-extensions Red Hat Single Sign-On 7 Not affected artemis-tools Red Hat Single Sign-On 7 Not affected artemis-wildfly-integration Red Hat Single Sign-On 7 Not affected libartemis-native-linux-i686 Red Hat Single Sign-On 7 Not affected libartemis-native-linux-x86_64 Red Hat Single Sign-On 7 Not affected wildfly-messaging-activemq https://www.cve.org/CVERecord?id=CVE-2026-50750 https://nvd.nist.gov/vuln/detail/CVE-2026-50750 https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr