CVE-2026-39304

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-39304
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS. Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/09/17 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*
History

01 May 2026, 15:21

Type Values Removed Values Added
First Time Apache activemq Broker
Apache activemq
Apache
References () https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt - () https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt - Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/04/09/17 - () http://www.openwall.com/lists/oss-security/2026/04/09/17 - Mailing List, Third Party Advisory
CPE cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*

10 Apr 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-400

10 Apr 2026, 12:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/04/09/17 -

10 Apr 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-10 11:16

Updated : 2026-05-01 15:21

NVD link : CVE-2026-39304

Mitre link : CVE-2026-39304

CVE.ORG link : CVE-2026-39304

JSON object : View

Products Affected

apache

  • activemq_broker
  • activemq
CWE
CWE-400

Uncontrolled Resource Consumption