CVE-2026-50734 Overview
CVE-2026-50734 is a memory allocation vulnerability [CWE-789] affecting Apache ActiveMQ, Apache ActiveMQ Client, and Apache ActiveMQ All. An unauthenticated remote attacker can crash the broker by sending a crafted WireFormatInfo frame containing a malicious size value. The broker fails to validate the value and attempts a large memory allocation during pre-authentication negotiation, triggering an out-of-memory (OOM) condition.
The issue affects all versions before 5.19.8 and versions 6.0.0 through 6.2.6. Apache has released fixed versions 5.19.8 and 6.2.7.
Critical Impact
Unauthenticated network attackers can crash Apache ActiveMQ brokers remotely by sending a single crafted WireFormatInfo frame, causing denial of service for all message queue consumers.
Affected Products
- Apache ActiveMQ Client: versions before 5.19.8 and 6.0.0 through 6.2.6
- Apache ActiveMQ: versions before 5.19.8 and 6.0.0 through 6.2.6
- Apache ActiveMQ All: versions before 5.19.8 and 6.0.0 through 6.2.6
Discovery Timeline
- 2026-06-30 - CVE-2026-50734 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-50734
Vulnerability Analysis
Apache ActiveMQ uses the OpenWire protocol to negotiate wire-format parameters between clients and brokers. The negotiation begins with a WireFormatInfo frame exchanged before any authentication occurs. This frame includes size and marshalling metadata that the broker consumes to prepare buffers for subsequent traffic.
The broker reads a size field from the incoming frame and allocates memory based on that value without bounding checks. An attacker can supply an arbitrarily large integer, causing the Java Virtual Machine (JVM) to attempt an allocation that exceeds available heap capacity. The result is an OutOfMemoryError that terminates the broker process or leaves it unresponsive to legitimate clients.
Because the flaw resides in the pre-authentication code path, no credentials, session state, or user interaction are required. A single TCP connection to the OpenWire listener (default port 61616) is sufficient to trigger the condition.
Root Cause
The root cause is missing validation of an attacker-controlled length field in the OpenWire WireFormatInfo handler. The vulnerability is classified as [CWE-789: Memory Allocation with Excessive Size Value]. The broker trusts the client-supplied size and passes it directly to allocation routines without comparing it against a maximum frame size threshold.
Attack Vector
Exploitation requires network reachability to an OpenWire listener. The attacker opens a TCP connection to the broker port and transmits a malformed WireFormatInfo frame with an oversized size value. The broker attempts the allocation, exhausts heap memory, and crashes. Repeated connections can prevent recovery on hosts configured to auto-restart the service.
Refer to the Apache Security Discussion Thread and the OpenWall OSS-Security Update for protocol-level details.
Detection Methods for CVE-2026-50734
Indicators of Compromise
- Broker logs showing java.lang.OutOfMemoryError: Java heap space originating from OpenWire negotiation threads
- Abrupt broker termination or JVM crash dumps generated shortly after inbound TCP connections to port 61616
- Short-lived connections from unknown source IPs that disconnect immediately after the initial WireFormatInfo exchange
Detection Strategies
- Monitor ActiveMQ broker logs for repeated OutOfMemoryError events tied to the WireFormatNegotiator or transport initialization stack traces
- Inspect OpenWire traffic for WireFormatInfo frames with unusually large declared size fields exceeding typical negotiation payloads
- Correlate broker crashes and restarts with inbound connections from external or untrusted network segments
Monitoring Recommendations
- Alert on broker process restarts and heap exhaustion events through Java Management Extensions (JMX) or process supervisors
- Track connection rate anomalies on the OpenWire listener port and flag single-frame disconnects
- Enable network flow logging in front of ActiveMQ brokers to identify pre-auth scanning behavior against port 61616
How to Mitigate CVE-2026-50734
Immediate Actions Required
- Upgrade Apache ActiveMQ to version 5.19.8 or 6.2.7 as recommended by the vendor
- Restrict network access to the OpenWire listener (61616) to trusted broker clients using firewall rules or network segmentation
- Review broker crash logs for prior evidence of exploitation and reset affected instances
Patch Information
Apache has released fixed versions 5.19.8 and 6.2.7. Both include validation of the WireFormatInfo size field to reject oversized values before allocation. Details are published in the Apache Security Discussion Thread.
Workarounds
- Place ActiveMQ brokers behind a reverse proxy or firewall that limits access to authenticated internal networks only
- Configure JVM heap limits and process supervision so a crashed broker is restarted automatically until patching is complete
- Disable exposure of the OpenWire transport on public interfaces if it is not required for external clients
# Restrict OpenWire listener to internal subnet using iptables
iptables -A INPUT -p tcp --dport 61616 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 61616 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
