sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-75880 Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service

Medium 6.5 Published Updated

An authenticated attacker can cause denial of service in Apache ActiveMQ Artemis by using crafted message selectors that exhaust broker threads.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2026-75880?

CVE-2026-75880 is a medium-severity denial of service vulnerability in Apache ActiveMQ Artemis, published on 10 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service.

This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.57.0, which fixes this issue.

Weakness: CWE-1333

Which versions are affected by CVE-2026-75880?

It affects 1 product.

Products include Apache Artemis.

How do I fix CVE-2026-75880?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-75880 being exploited?

There is no known exploitation of CVE-2026-75880 in the wild and no public exploit code.

Sources

Also known as GHSA-c9m2-388v-p4rq.

Is CVE-2026-75880 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free