CVE-2026-50750: 
Apache ActiveMQ Classic vulnerability analysis and mitigation

CVE-2026-50750 is a Denial of Service via Out of Memory (OOM) vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, and Apache ActiveMQ All. An unauthenticated attacker can crash the broker by repeatedly sending BrokerInfo commands without a corresponding ConnectionInfo, exhausting the broker's heap memory. This vulnerability emerged as a regression following the fix for CVE-2026-49270. Affected versions are 5.19.7 (fixed in 5.19.8) and 6.2.6 (fixed in 6.2.7). It was disclosed on June 29, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Apache Advisory, GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerability arises because the fix for CVE-2026-49270 introduced a code path where the broker accumulates state for each incoming BrokerInfo command without enforcing a limit or requiring a valid ConnectionInfo handshake to complete. An unauthenticated remote attacker can exploit this by opening a network connection to the ActiveMQ broker port and repeatedly sending BrokerInfo protocol commands, causing unbounded memory allocation until the JVM throws an OutOfMemoryError and the broker process crashes. No authentication, user interaction, or special privileges are required (Apache Advisory, GitHub Advisory).

Successful exploitation results in a complete availability loss of the Apache ActiveMQ broker service, as the JVM crashes with an OutOfMemoryError. There is no confidentiality or integrity impact — the attack is purely a denial of service. Any applications, microservices, or systems dependent on the affected ActiveMQ broker for messaging would be disrupted until the service is manually restarted and the vulnerability is patched (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify internet-facing or network-accessible Apache ActiveMQ broker instances running versions 5.19.7 or 6.2.6 using tools like Shodan, Censys, or Nmap scanning for the default OpenWire port (61616).
2. Establish TCP connection: Open a raw TCP connection to the broker's OpenWire port (default 61616) without completing the standard connection handshake (i.e., do not send a ConnectionInfo command).
3. Send repeated BrokerInfo commands: Craft and repeatedly transmit BrokerInfo protocol commands over the OpenWire protocol in a loop. Each command causes the broker to allocate memory without releasing it, as no ConnectionInfo is provided to complete or close the session.
4. Exhaust broker memory: Continue sending BrokerInfo commands at high frequency until the broker's JVM heap is exhausted, triggering an OutOfMemoryError and crashing the ActiveMQ broker process.
5. Confirm denial of service: Verify the broker is unresponsive by attempting a legitimate connection or monitoring broker logs for OOM errors (Apache Advisory, GitHub Advisory).

• Network: High volume of inbound TCP connections to the ActiveMQ broker port (default 61616) from a single or small set of source IPs; connections that remain open without completing the OpenWire handshake (no ConnectionInfo observed after BrokerInfo).
• Logs: ActiveMQ broker logs (activemq.log) showing repeated BrokerInfo command processing without corresponding ConnectionInfo entries; Java OutOfMemoryError stack traces in broker logs immediately preceding a crash.
• Process: Sudden termination of the ActiveMQ JVM process; abnormal JVM heap usage growth visible in JMX monitoring or GC logs prior to crash.
• System: Unexpected broker service restarts or crash dumps in the ActiveMQ data directory (Apache Advisory, Red Hat Bugzilla).

The primary remediation is to upgrade Apache ActiveMQ to version 5.19.8 or 6.2.7, both of which contain the fix (Apache Advisory). As a network-level workaround prior to patching, administrators should restrict access to the ActiveMQ broker port (default 61616) using firewall rules or network ACLs to trusted clients only, and consider implementing rate limiting on inbound connections. Monitoring for unusual connection patterns or rapid memory growth on the broker can provide early warning of exploitation attempts.

The vulnerability was announced via the Apache security mailing list on June 29, 2026, and was picked up by security aggregators including SecurityOnline.info, VulDB, and Tenable (Nessus plugin 324494) shortly after disclosure (Apache Advisory). Red Hat tracked the issue in Bugzilla with a high severity rating and assigned it to their product security team for assessment across affected Red Hat products (Red Hat Bugzilla). Community discussion was noted on Bluesky (infosec.skyfleet.blue) and OSS-Sec mailing lists, reflecting standard industry attention for a medium-high severity DoS in a widely deployed messaging broker.