# CVE-2026-39304: Apache ActiveMQ DoS via memory exhaustion in NIO SSL transport

Source: https://junglewise.ai/threats/cve-2026-39304-apache-activemq-dos-via-memory-exhaustion-in-nio-ssl-transport  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-39304 · Severity: high · CVSS 7.5 · Published 2026-04-10

Apache ActiveMQ, a widely used open-source message broker, is vulnerable to a denial-of-service attack. An attacker can exploit a flaw in how the system handles secure connection updates to rapidly consume all available server memory. This results in the message broker becoming unresponsive, potentially disrupting business operations and data flow between applications.

Technologies: [Apache Activemq Broker](https://junglewise.ai/threats/technologies/activemq-broker), [Apache Software Foundation ActiveMQ All](https://junglewise.ai/threats/technologies/activemq-all), [Apache Software Foundation ActiveMQ Client](https://junglewise.ai/threats/technologies/activemq-client), [org.apache.activemq:activemq-all (Maven)](https://junglewise.ai/threats/technologies/org-apache-activemq-activemq-all), [org.apache.activemq:activemq-broker (Maven)](https://junglewise.ai/threats/technologies/org-apache-activemq-activemq-broker), [org.apache.activemq:activemq-client (Maven)](https://junglewise.ai/threats/technologies/org-apache-activemq-activemq-client), [org.apache.activemq:apache-activemq (Maven)](https://junglewise.ai/threats/technologies/org-apache-activemq-apache-activemq). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-39304 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39304 being exploited in the wild.

**How severe is CVE-2026-39304?** High severity, with a CVSS score of 7.5, published 10 April 2026.

**Which products and versions are affected?** Apache Activemq Broker before 5.19.4, 6.0.0 before 6.2.4; Apache Software Foundation ActiveMQ All < 5.19.4, 6.0.0 to < 6.2.4; Apache Software Foundation ActiveMQ Client < 5.19.4, 6.0.0 to < 6.2.4; org.apache.activemq:activemq-all (Maven) ECOSYSTEM:introduced=0,fixed=5.19.4; and 3 more.

**Is there a fix for CVE-2026-39304?** Yes. org.apache.activemq:activemq-all (Maven): upgrade to 5.19.4 or later; org.apache.activemq:activemq-broker (Maven): upgrade to 5.19.4 or later; org.apache.activemq:activemq-client (Maven): upgrade to 5.19.4 or later; org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39304 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39304?** Check whether you run Apache Activemq Broker, Apache Software Foundation ActiveMQ All, Apache Software Foundation ActiveMQ Client or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.activemq:activemq-all (Maven): upgrade to 5.19.4 or later

  ```sh
  # set org.apache.activemq:activemq-all to 5.19.4 in your pom.xml or build.gradle
  ```

- org.apache.activemq:activemq-broker (Maven): upgrade to 5.19.4 or later

  ```sh
  # set org.apache.activemq:activemq-broker to 5.19.4 in your pom.xml or build.gradle
  ```

- org.apache.activemq:activemq-client (Maven): upgrade to 5.19.4 or later

  ```sh
  # set org.apache.activemq:activemq-client to 5.19.4 in your pom.xml or build.gradle
  ```

- org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.4 or later

  ```sh
  # set org.apache.activemq:apache-activemq to 5.19.4 in your pom.xml or build.gradle
  ```


## Technical details

A resource exhaustion vulnerability exists in Apache ActiveMQ's NIO SSL transport component. The root cause is the incorrect handling of TLSv1.3 handshake KeyUpdate messages triggered by clients. A remote, unauthenticated attacker can rapidly send these update requests, causing the SSL engine to exhaust the broker's available memory (OOM). While TLS versions prior to 1.3 (like TLSv1.2) are also affected by a related flaw that can cause connections to hang, they do not trigger the specific OOM condition. The issue is resolved in versions 5.19.5 and 6.2.4.

## Affected products

- Apache ActiveMQ Client before 5.19.4, 6.0.0 before 6.2.4
- Apache ActiveMQ Broker before 5.19.4, 6.0.0 before 6.2.4
- Apache ActiveMQ All before 5.19.4, 6.0.0 before 6.2.4

## Identifiers

- CVE-2026-39304
- GHSA-5568-6qcg-g7fx

## Timeline

- 2026-04-09: disclosed: Initial disclosure on oss-security mailing list
- 2026-04-10: advisory: NVD publication date

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt](https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt)
- [http://www.openwall.com/lists/oss-security/2026/04/09/17](http://www.openwall.com/lists/oss-security/2026/04/09/17)
- [https://access.redhat.com/security/cve/CVE-2026-39304](https://access.redhat.com/security/cve/CVE-2026-39304)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2457275](https://bugzilla.redhat.com/show_bug.cgi?id=2457275)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39304.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39304.json)

## Related threats

- [Apache ActiveMQ input validation bypass in TopicRegion](https://junglewise.ai/threats/cve-2026-74761-apache-activemq-input-validation-bypass-in-topicregion)
- [Apache ActiveMQ missing authorization in temporary destinations](https://junglewise.ai/threats/cve-2026-54475-apache-activemq-missing-authorization-in-temporary-destinations)
- [Apache ActiveMQ DoS via excessive memory allocation in OpenWire map unmarshaling](https://junglewise.ai/threats/cve-2026-53917-apache-activemq-dos-via-excessive-memory-allocation-in-openwire)
- [Apache ActiveMQ denial of service via STOMP NIO heap exhaustion](https://junglewise.ai/threats/cve-2026-53916-apache-activemq-denial-of-service-via-stomp-nio-heap-exhaustion)
- [Apache ActiveMQ stored XSS in Web Console browse page](https://junglewise.ai/threats/cve-2026-52760-apache-activemq-stored-xss-in-web-console-browse-page)