Executive brief
Apache ActiveMQ Artemis is a widely-used message broker that routes and delivers messages between applications. An authenticated user can exploit a flaw in how the broker processes message routing selectors, causing excessive CPU consumption on broker threads and rendering the service unresponsive. This impacts message delivery availability across the entire broker.
Technical details
This is a denial-of-service vulnerability caused by inefficient evaluation of crafted wildcard patterns in message consumer selectors. An authenticated client can attach a consumer with a specially-crafted selector containing malicious wildcard usage that triggers exponential or excessive computational overhead during message delivery matching. The vulnerability requires authentication but no additional user interaction. An attacker can occupy shared broker threads, preventing legitimate message processing and causing a denial of service. The issue affects Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 and Apache Artemis 2.50.0 through 2.56.0; upgrading to version 2.57.0 or later resolves the issue.
Affected products
- Apache ActiveMQ Artemis 1.0.0 through 2.44.0
- Apache Artemis 2.50.0 through 2.56.0
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in version 2.57.0