CVE-2026-75880: Apache Artemis DoS Vulnerability

CVE-2026-75880 Overview

CVE-2026-75880 affects Apache ActiveMQ Artemis and Apache Artemis message brokers. An authenticated client can attach a consumer using a JMS selector that contains crafted wildcard patterns. During message delivery evaluation, the selector triggers excessive processing on a shared broker thread. The result is a denial of service that degrades broker responsiveness for other consumers and producers.

The issue is tracked as [CWE-1333] Inefficient Regular Expression Complexity. It affects Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0. The Apache ActiveMQ project recommends upgrading to version 2.57.0, which contains the fix.

Critical Impact
Any authenticated client with permission to create a consumer can exhaust shared broker threads, disrupting message delivery across the broker.

Affected Products

Apache Artemis: 2.50.0 through 2.56.0
Apache ActiveMQ Artemis: 1.0.0 through 2.44.0
Fixed in Apache ActiveMQ Artemis 2.57.0

Discovery Timeline

2026-09-10 - CVE-2026-75880 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75880

Vulnerability Analysis

Apache ActiveMQ Artemis allows JMS consumers to attach a message selector when subscribing to a queue or topic. Selectors filter messages based on header and property expressions, and the broker evaluates each selector on every candidate message. When a selector includes crafted wildcard usage, the evaluation logic performs excessive work per message.

Because selector evaluation runs on a shared broker thread during delivery, a single misbehaving consumer stalls that thread. Concurrent producers and consumers on the same broker experience delivery delays or timeouts. The condition is characterized under [CWE-1333] Inefficient Regular Expression Complexity, which covers algorithmic pattern-matching complexity issues.

Root Cause

The root cause is inefficient handling of wildcard patterns in selector expression evaluation. Specific inputs cause the matcher to perform disproportionate work relative to input length. Without an upper bound on evaluation cost per message, the shared delivery thread becomes occupied and cannot service other clients.

Attack Vector

Exploitation requires an authenticated client with permission to create a consumer on any addressable destination. The attacker connects using standard JMS, AMQP, STOMP, or MQTT client libraries, then subscribes with a selector containing the crafted wildcard expression. Every subsequent message delivery attempt on that destination triggers the expensive evaluation. No specialized tooling is needed beyond a supported protocol client.

See the Apache Mail Thread announcement and the Openwall OSS Security post for the vendor description.

Detection Methods for CVE-2026-75880

Indicators of Compromise

Broker threads showing sustained high CPU tied to selector evaluation stack frames such as org.apache.activemq.artemis.selector.
Consumer subscription events referencing unusually long or wildcard-heavy selector strings in broker audit logs.
Growing message delivery latency and queue depth on destinations serving affected consumers.

Detection Strategies

Enable Artemis audit logging and inspect CREATE_CONSUMER events for selector expressions with nested wildcards or extreme length.
Baseline broker thread utilization and alert on sustained saturation of message delivery threads.
Correlate authenticated user sessions with the source of high-cost selectors to identify offending clients.

Monitoring Recommendations

Export Artemis JMX metrics such as DeliveringCount, ScheduledCount, and thread pool utilization to your SIEM or observability stack.
Alert on abnormal ratios of consumer subscriptions to message throughput per authenticated principal.
Capture broker thread dumps on latency spikes to confirm whether selector evaluation frames dominate execution time.

How to Mitigate CVE-2026-75880

Immediate Actions Required

Upgrade Apache ActiveMQ Artemis to version 2.57.0, which contains the fix.
Inventory all authenticated principals with permission to create consumers and revoke unnecessary access.
Review recent consumer subscriptions for unexpected or overly complex selector expressions.

Patch Information

The Apache ActiveMQ project fixed this issue in Apache ActiveMQ Artemis 2.57.0. Users on Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0 should upgrade. Refer to the Apache Mail Thread announcement for release details.

Workarounds

Restrict createDurableQueue, createNonDurableQueue, and consume permissions to trusted roles in broker.xml security settings.
Terminate consumer sessions that submit high-complexity selectors and revoke the associated credentials.
Isolate untrusted tenants on separate broker instances so a stalled thread pool does not impact critical workloads.

bash

# Verify the running Artemis version and upgrade path
./artemis version
# Expected output after remediation: Apache ActiveMQ Artemis 2.57.0