Executive brief
Apache ActiveMQ, a widely used open-source message broker, is vulnerable to a denial-of-service attack. An attacker can exploit a flaw in how the system handles secure connection updates to rapidly consume all available server memory. This results in the message broker becoming unresponsive, potentially disrupting business operations and data flow between applications.
Technical details
A resource exhaustion vulnerability exists in Apache ActiveMQ's NIO SSL transport component. The root cause is the incorrect handling of TLSv1.3 handshake KeyUpdate messages triggered by clients. A remote, unauthenticated attacker can rapidly send these update requests, causing the SSL engine to exhaust the broker's available memory (OOM). While TLS versions prior to 1.3 (like TLSv1.2) are also affected by a related flaw that can cause connections to hang, they do not trigger the specific OOM condition. The issue is resolved in versions 5.19.5 and 6.2.4.
Affected products
- Apache ActiveMQ Client before 5.19.4, 6.0.0 before 6.2.4
- Apache ActiveMQ Broker before 5.19.4, 6.0.0 before 6.2.4
- Apache ActiveMQ All before 5.19.4, 6.0.0 before 6.2.4
Timeline
- 2026-04-09: disclosed: Initial disclosure on oss-security mailing list
- 2026-04-10: advisory: NVD publication date
References
- https://repo.maven.apache.org/maven2
- https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt
- http://www.openwall.com/lists/oss-security/2026/04/09/17
- https://access.redhat.com/security/cve/CVE-2026-39304
- https://bugzilla.redhat.com/show_bug.cgi?id=2457275
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39304.json