CVE-2026-50734: Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.
An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQ Clientto a version that resolves this vulnerability.Fixed in 5.19.8 - Upgrade
Upgrade
Apache ActiveMQ Clientto a version that resolves this vulnerability.Fixed in 6.2.7 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.19.8 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.2.7 - Upgrade
Upgrade
Apache ActiveMQ Allto a version that resolves this vulnerability.Fixed in 5.19.8 - Upgrade
Upgrade
Apache ActiveMQ Allto a version that resolves this vulnerability.Fixed in 6.2.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50734?
The severity of CVE-2026-50734 is high with a CVSS score of 7.5.
How does CVE-2026-50734 affect Apache ActiveMQ?
CVE-2026-50734 allows an unauthenticated network attacker to cause a denial of service on the broker by sending a maliciously crafted WireFormatInfo frame.
What is the risk associated with CVE-2026-50734?
The risk associated with CVE-2026-50734 is rated at 46, indicating significant potential impact.
How do I fix CVE-2026-50734?
To fix CVE-2026-50734, update to the latest version of Apache ActiveMQ that addresses this memory allocation vulnerability.
When was CVE-2026-50734 published?
CVE-2026-50734 was published on June 29, 2026.