---
id: CVE-2026-50750
aliases:
  - GHSA-9qj4-v6r6-3wmx
title: >-
  Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of
  Service via Out of Memory vulnerability
summary: >-
  Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of
  Service via Out of Memory vulnerability
severity: high
cvss: 7.5
cwe:
  - CWE-400
vendor: apache
product: 'org.apache.activemq:activemq-broker'
ecosystem: maven
affected:
  - 'org.apache.activemq:activemq-broker = 5.19.7'
  - 'org.apache.activemq:activemq-broker = 6.2.6'
  - 'org.apache.activemq:apache-activemq = 5.19.7'
  - 'org.apache.activemq:apache-activemq = 6.2.6'
  - 'org.apache.activemq:activemq-all = 5.19.7'
  - 'org.apache.activemq:activemq-all = 6.2.6'
patched:
  - 'org.apache.activemq:activemq-broker 5.19.8'
  - 'org.apache.activemq:activemq-broker 6.2.7'
  - 'org.apache.activemq:apache-activemq 5.19.8'
  - 'org.apache.activemq:apache-activemq 6.2.7'
  - 'org.apache.activemq:activemq-all 5.19.8'
  - 'org.apache.activemq:activemq-all 6.2.7'
published: '2026-06-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T16:07:53Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-9qj4-v6r6-3wmx'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50750'
  - url: 'https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr'
  - url: 'https://github.com/apache/activemq/pull/2083'
  - url: >-
      https://github.com/apache/activemq/commit/685ab0b7a4618abd25be7d64c3355401581b69e5
  - url: >-
      https://github.com/apache/activemq/commit/80562ea8d327b7f538de1ff7672f158fe2abc4c1
  - url: >-
      https://github.com/apache/activemq/commit/f3a365e74e85dee6042f324156ace661e0d97f2d
  - url: 'https://github.com/apache/activemq/releases/tag/activemq-5.19.8'
  - url: 'https://github.com/apache/activemq/releases/tag/activemq-6.2.7'
  - url: 'https://github.com/advisories/GHSA-9qj4-v6r6-3wmx'
tags:
  - ghsa
  - maven
epss: 0.00686
epssPercentile: 0.52739
ingestedAt: '2026-11-04T16:18:35.577Z'
---

## Overview

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Following the fix for  CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM.
This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.

Users are recommended to upgrade to version 6.2.7, which fixes the issue.

## Affected packages

- `org.apache.activemq:activemq-broker = 5.19.7`
- `org.apache.activemq:activemq-broker = 6.2.6`
- `org.apache.activemq:apache-activemq = 5.19.7`
- `org.apache.activemq:apache-activemq = 6.2.6`
- `org.apache.activemq:activemq-all = 5.19.7`
- `org.apache.activemq:activemq-all = 6.2.6`

## Remediation

Upgrade to a patched release:

- `org.apache.activemq:activemq-broker 5.19.8`
- `org.apache.activemq:activemq-broker 6.2.7`
- `org.apache.activemq:apache-activemq 5.19.8`
- `org.apache.activemq:apache-activemq 6.2.7`
- `org.apache.activemq:activemq-all 5.19.8`
- `org.apache.activemq:activemq-all 6.2.7`