Aller au contenu
en Se connecter
Non notée

CVE-2026-39304 Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ

Description

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS. Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache ActiveMQ Client 6.0 6.0.0 → < 6.2.4 6.2.4
Apache ActiveMQ Client 5.19 premières → < 5.19.4 5.19.4
Apache ActiveMQ Broker 6.0 6.0.0 → < 6.2.4 6.2.4
Apache ActiveMQ Broker 5.19 premières → < 5.19.4 5.19.4
Apache ActiveMQ All 6.0 6.0.0 → < 6.2.4 6.2.4
Apache ActiveMQ All 5.19 premières → < 5.19.4 5.19.4
Apache ActiveMQ 6.0 6.0.0 → < 6.2.4 6.2.4
Apache ActiveMQ 5.19 premières → < 5.19.4 5.19.4
Red Hat Fuse 7 Versions non publiées
Afficher les 8 autres branches
Produit Versions touchées Corrigé en
Red Hat AMQ Broker 7 Versions non publiées
Red Hat build of Apache Camel for Spring Boot 4 Versions non publiées
Red Hat Data Grid 8 Versions non publiées
Red Hat Enterprise Linux 8 Versions non publiées
Red Hat Enterprise Linux 9 Versions non publiées
Red Hat JBoss Enterprise Application Platform 7 Versions non publiées
Red Hat JBoss Enterprise Application Platform 8 Versions non publiées
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache ActiveMQ Client

Les 4 CVE de Apache ActiveMQ Client →
CVE-2026-50734 Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ… Non notée CVE-2026-53917 Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ… Non notée CVE-2026-33227 Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache… Non notée
Suivre cette CVE