CVE-2026-50750: Apache ActiveMQ DoS Vulnerability

CVE-2026-50750 Overview

CVE-2026-50750 is a denial of service vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All. An unauthenticated remote attacker can exhaust broker memory by sending repeated BrokerInfo commands without a corresponding ConnectionInfo, causing the broker to crash with an OutOfMemoryError.

The flaw is a regression introduced by the fix for CVE-2026-49270. It is categorized under [CWE-400] (Uncontrolled Resource Consumption) and impacts availability only. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Critical Impact
Unauthenticated attackers can crash Apache ActiveMQ brokers remotely over the network by exhausting heap memory, disrupting message-driven applications and dependent services.

Affected Products

Apache ActiveMQ Broker: 5.19.7 (before 5.19.8) and 6.2.6 (before 6.2.7)
Apache ActiveMQ: 5.19.7 (before 5.19.8) and 6.2.6 (before 6.2.7)
Apache ActiveMQ All: 5.19.7 (before 5.19.8) and 6.2.6 (before 6.2.7)

Discovery Timeline

2026-06-30 - CVE-2026-50750 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-50750

Vulnerability Analysis

Apache ActiveMQ uses the OpenWire protocol to negotiate connections between clients and brokers. During normal handshake flow, a client sends a BrokerInfo command followed by a ConnectionInfo command to establish state within the broker.

This vulnerability enables an unauthenticated attacker to send repeated BrokerInfo commands without ever sending a ConnectionInfo. The broker accumulates state for each unpaired BrokerInfo message without applying a bound or timeout. Heap memory grows until the Java Virtual Machine (JVM) throws an OutOfMemoryError and the broker process terminates.

The issue is a regression from the remediation applied for CVE-2026-49270. The prior fix did not account for BrokerInfo commands arriving in isolation, leaving an unmetered allocation path exposed on the OpenWire listener.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400]. The broker allocates memory for each incoming BrokerInfo command but does not enforce rate limits, per-connection quotas, or state cleanup when the expected ConnectionInfo never arrives.

Attack Vector

Exploitation requires only network reachability to the broker's OpenWire port (typically TCP 61616). No authentication, user interaction, or specialized privileges are needed. An attacker opens one or more TCP sessions and repeatedly emits BrokerInfo frames until the JVM heap is exhausted.

No verified public proof-of-concept code is available at the time of publication. The vulnerability mechanism is documented in the Apache Mailing List Thread.

Detection Methods for CVE-2026-50750

Indicators of Compromise

Repeated OpenWire BrokerInfo command frames from a single source without matching ConnectionInfo frames
ActiveMQ broker logs showing java.lang.OutOfMemoryError: Java heap space followed by broker termination
Sustained heap growth on the ActiveMQ JVM without a corresponding increase in legitimate producer or consumer sessions
Unusually high half-open or short-lived connections to TCP port 61616

Detection Strategies

Inspect OpenWire traffic for anomalous ratios of BrokerInfo to ConnectionInfo commands per source IP.
Alert on ActiveMQ broker restarts correlated with JVM OutOfMemoryError events in activemq.log.
Baseline connection metrics from JMX and flag deviations in TotalConnectionsCount versus active sessions.

Monitoring Recommendations

Collect JVM heap utilization and garbage collection metrics from ActiveMQ hosts and forward them to a central telemetry pipeline.
Monitor broker logs for repeated connection setup failures and abrupt process exits.
Enable network flow logging on the OpenWire listener port to correlate volumetric anomalies with broker crashes.

How to Mitigate CVE-2026-50750

Immediate Actions Required

Upgrade Apache ActiveMQ, ActiveMQ Broker, and ActiveMQ All to version 6.2.7 or 5.19.8 on affected deployments.
Restrict network access to the OpenWire port 61616 so only trusted producer and consumer hosts can reach the broker.
Enforce authentication on the broker transport connector to reduce exposure to unauthenticated command floods.
Review broker JVM configuration and set heap and connection limits appropriate to expected client load.

Patch Information

The Apache ActiveMQ project resolved the flaw in versions 5.19.8 and 6.2.7. Refer to the Apache Mailing List Thread for the official announcement and upgrade guidance. All 5.19.7 and 6.2.6 deployments should upgrade without delay.

Workarounds

Place ActiveMQ brokers behind a firewall or reverse proxy that enforces per-source connection rate limits.
Enable transport-level authentication and access control lists in activemq.xml to block unauthenticated peers.
Reduce broker JVM crash impact by running ActiveMQ under a supervisor with automatic restart and alerting.

bash

# Example transport connector hardening in activemq.xml
# Restrict OpenWire to a specific interface and require authentication
<transportConnectors>
  <transportConnector name="openwire"
    uri="tcp://10.0.0.10:61616?maximumConnections=1000&wireFormat.maxFrameSize=104857600"/>
</transportConnectors>

<plugins>
  <simpleAuthenticationPlugin anonymousAccessAllowed="false">
    <users>
      <authenticationUser username="app" password="CHANGE_ME" groups="producers,consumers"/>
    </users>
  </simpleAuthenticationPlugin>
</plugins>