Is CVE-2026-75880 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75880 being exploited in the wild.

How severe is CVE-2026-75880?

Medium severity, with a CVSS score of 6.5, published 10 September 2026.

Which products and versions are affected?

Apache Activemq Artemis 1.0.0 through 2.44.0; Apache Artemis 2.50.0 through 2.56.0.

Is there a fix for CVE-2026-75880?

A patch was published on 2026-09-10: Fixed in version 2.57.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75880 attacked?

It is attacked over the network.

Am I affected by CVE-2026-75880?

Check whether you run Apache Activemq Artemis or Apache Artemis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75880: Apache ActiveMQ Artemis denial of service via crafted wildcard selector

CVE-2026-75880 · Severity: medium · CVSS 6.5 · Published 2026-09-10

Apache ActiveMQ Artemis is a widely-used message broker that routes and delivers messages between applications. An authenticated user can exploit a flaw in how the broker processes message routing selectors, causing excessive CPU consumption on broker threads and rendering the service unresponsive. This impacts message delivery availability across the entire broker.

Technologies: Apache Activemq Artemis, Apache Artemis. Vendors: Apache.

Quick answers

Is CVE-2026-75880 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75880 being exploited in the wild.
How severe is CVE-2026-75880?: Medium severity, with a CVSS score of 6.5, published 10 September 2026.
Which products and versions are affected?: Apache Activemq Artemis 1.0.0 through 2.44.0; Apache Artemis 2.50.0 through 2.56.0.
Is there a fix for CVE-2026-75880?: A patch was published on 2026-09-10: Fixed in version 2.57.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75880 attacked?: It is attacked over the network.
Am I affected by CVE-2026-75880?: Check whether you run Apache Activemq Artemis or Apache Artemis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a denial-of-service vulnerability caused by inefficient evaluation of crafted wildcard patterns in message consumer selectors. An authenticated client can attach a consumer with a specially-crafted selector containing malicious wildcard usage that triggers exponential or excessive computational overhead during message delivery matching. The vulnerability requires authentication but no additional user interaction. An attacker can occupy shared broker threads, preventing legitimate message processing and causing a denial of service. The issue affects Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 and Apache Artemis 2.50.0 through 2.56.0; upgrading to version 2.57.0 or later resolves the issue.

Affected products

Apache ActiveMQ Artemis 1.0.0 through 2.44.0
Apache Artemis 2.50.0 through 2.56.0

Timeline

2026-09-10: disclosed
2026-09-10: patched: Fixed in version 2.57.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.