CVE-2026-49362: Apache Artemis Queue Creation DoS Vulnerability

CVE-2026-49362 Overview

CVE-2026-49362 affects Apache ActiveMQ Artemis and allows an unauthenticated remote attacker to create arbitrary durable queues through the CORE protocol. The flaw is rooted in missing authentication ([CWE-306]) on a broker-facing operation that should require authenticated access. Successful exploitation manipulates broker state and can lead to denial of service through queue proliferation and resource exhaustion.

The vulnerability affects Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0. The Apache project recommends upgrading to version 2.57.0, which contains the fix.

Critical Impact
Remote unauthenticated attackers can create durable queues that persist across broker restarts, corrupting broker state and exhausting storage or memory.

Affected Products

Apache Artemis versions 2.50.0 through 2.56.0
Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0
Deployments exposing the CORE protocol listener to untrusted networks

Discovery Timeline

2026-09-10 - CVE-2026-49362 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-49362

Vulnerability Analysis

Apache ActiveMQ Artemis is a message broker that supports multiple wire protocols, including its native CORE protocol. The broker exposes queue-management operations over this protocol. In affected versions, the queue creation code path accessible via CORE does not enforce authentication, permitting any client that can reach the listener to submit queue creation requests.

Because the created queues are durable, they persist to disk and survive broker restarts. An attacker who repeatedly invokes the operation can inflate the broker's persistent state, consume disk and journal capacity, and slow legitimate message processing. Broker recovery time after restart also grows as the number of durable queues increases.

The issue is classified as Missing Authentication for Critical Function under [CWE-306]. It applies to Apache Artemis and to the ActiveMQ Artemis lineage, so operators of both distributions are exposed until the patched release is deployed.

Root Cause

The root cause is an authorization gap in the CORE protocol handler for queue creation. The operation reaches durable queue persistence logic without validating the caller's credentials or role.

Attack Vector

An attacker connects to the CORE protocol listener on the broker and issues a queue creation request without providing credentials. The broker accepts the request and writes a durable queue entry. Repeated requests scale the impact from state manipulation to denial of service.

No verified public exploit code is available at time of writing. Refer to the Apache Mailing List Thread and the OpenWall OSS Security Post for technical detail from the maintainers.

Detection Methods for CVE-2026-49362

Indicators of Compromise

Unexpected growth in the number of durable queues reported by the broker's management API or JMX metrics
Journal or paging directory size increasing without corresponding legitimate traffic
CORE protocol connections from source addresses outside expected application tiers
Broker log entries showing queue creation events without a preceding authenticated session

Detection Strategies

Compare the broker's current queue inventory against a known baseline and alert on new queues that do not match naming conventions used by internal services
Audit CORE listener access logs for connections from IP ranges that should not communicate directly with the broker
Correlate queue creation events with authentication events to identify operations executed without a corresponding successful login

Monitoring Recommendations

Enable and forward Artemis audit logs to a centralized log platform for retention and correlation
Monitor disk utilization and journal growth rate on broker hosts and alert on sustained anomalies
Track connection counts and source addresses on the CORE protocol port to identify unauthorized clients

How to Mitigate CVE-2026-49362

Immediate Actions Required

Upgrade Apache ActiveMQ Artemis and Apache Artemis to version 2.57.0 as recommended by the project
Restrict network access to the CORE protocol listener to trusted application hosts using firewall or security group rules
Review existing durable queues and remove any that were created without authorization
Rotate broker credentials if audit logs indicate unauthorized administrative activity

Patch Information

Apache published the fix in version 2.57.0. Refer to the Apache Mailing List Thread for the maintainer announcement and to the OpenWall OSS Security Post for the coordinated disclosure record. Operators running any release from 1.0.0 through 2.44.0 of ActiveMQ Artemis or 2.50.0 through 2.56.0 of Artemis must upgrade to eliminate the flaw.

Workarounds

Place the broker behind a network boundary that only permits connections from authenticated application services
Disable the CORE protocol acceptor if the deployment relies solely on other supported protocols such as AMQP, STOMP, or MQTT
Enforce broker-level security settings that require authentication for connection acceptance where the deployment permits

bash

# Example: restrict CORE listener to internal application subnet using iptables
iptables -A INPUT -p tcp --dport 61616 -s 10.20.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 61616 -j DROP