CVE-2026-50750 Denial of service in Apache ActiveMQ

High 7.5 Published 30 Jun 2026 Updated 30 Jun 2026

Unauthenticated attackers can crash the Apache ActiveMQ broker by sending repeated BrokerInfo commands, causing an out-of-memory denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-50750?

CVE-2026-50750 is a high-severity denial of service vulnerability in Apache Activemq, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.

Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Weakness: CWE-400

Which versions are affected by CVE-2026-50750?

1 open source package ship an affected version, including activemq. It affects 2 products.

Package	Affected	Fixed in
`activemq` Bitnami	From `5.19.7`	`5.19.8, 6.2.7`

Products include Apache Activemq, Apache Activemq Broker.

How do I fix CVE-2026-50750?

Upgrade activemq to a fixed version for your release line: 5.19.8 or 6.2.7.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-50750 being exploited?

There is no known exploitation of CVE-2026-50750 in the wild and no public exploit code.

All Apache Activemq vulnerabilities

Sources

Also known as BIT-activemq-2026-50750, DEBIAN-CVE-2026-50750, GHSA-9qj4-v6r6-3wmx, UBUNTU-CVE-2026-50750.