What is the CVSS score of CVE-2026-50750?

CVE-2026-50750 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Apache ActiveMQ are affected by CVE-2026-50750?

Apache ActiveMQ versions 5.19.7 and 6.2.6 are vulnerable to unauthenticated remote denial of service attacks that crash the message broker by exhausting heap memory.. A patch is available.

How to fix or mitigate CVE-2026-50750?

Within 24 hours: Identify all ActiveMQ deployments running versions 5.19.7 or 6.2.6; assess whether brokers are network-accessible from untrusted sources. Within 7 days: Deploy firewall rules restricting OpenWire protocol access (port 61616) to pre-approved internal networks only; configure connection rate limiting on affected brokers; enable heap memory monitoring with automated alerts. Within 30 days: Evaluate upgrade feasibility to unaffected ActiveMQ versions per vendor security guidance; if upgrades not viable, implement network segmentation isolating brokers behind restricted access controls.

Apache ActiveMQ CVE-2026-50750

EUVD-2026-40280 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-30 apache

GHSA-9qj4-v6r6-3wmx

Denial Of Service Apache Apache Activemq Broker Apache Activemq Apache Activemq All

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network attacker (AV:N, PR:N, UI:N) trivially repeats one command (AC:L); availability-only impact with broker OOM crash (A:H, C:N, I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jun 30, 2026 - 14:22 NVD

7.5 (HIGH)

Patch available

Jun 30, 2026 - 12:01 EUVD

Analysis Generated

Jun 30, 2026 - 11:15 vuln.today

DescriptionCVE.org

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.

Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Articles & Coverage 1

News 5 New Apache Vulnerabilities - 5 High Severity, No Public POC Jul 01, 2026

AnalysisAI

Remote denial of service in Apache ActiveMQ (versions 5.19.7 and 6.2.6) allows an unauthenticated attacker to exhaust broker heap memory and crash the service with an OutOfMemory error. The flaw is a regression introduced by the fix for CVE-2026-49270: an attacker repeatedly sends OpenWire BrokerInfo commands while never sending the expected ConnectionInfo, causing unbounded state accumulation until the broker dies. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach broker OpenWire port (61616)

Delivery

Open TCP connection to broker

Exploit

Send repeated BrokerInfo commands, omit ConnectionInfo

Execution

Broker accumulates unbounded memory

Persist

JVM heap exhausted, OutOfMemory crash

Impact

Messaging service denial

Access

Reach broker OpenWire port (61616)

Delivery

Open TCP connection to broker

Exploit

Send repeated BrokerInfo commands, omit ConnectionInfo

Execution

Broker accumulates unbounded memory

Persist

JVM heap exhausted, OutOfMemory crash

Impact

Messaging service denial

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the Apache ActiveMQ OpenWire transport listener (typically TCP 61616) and the ability to send raw OpenWire protocol commands; specifically, the attacker sends repeated BrokerInfo commands while never sending a ConnectionInfo command. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	No CVSS vector, EPSS score, or CWE was supplied in the input, so quantitative risk signals are absent and must be inferred. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach the broker's OpenWire port opens a connection and sends a stream of repeated BrokerInfo commands, deliberately omitting the ConnectionInfo command that would normally bound the connection state. Because each command accumulates broker memory without cleanup, the JVM heap fills and the broker crashes with an OutOfMemory error, taking down message delivery for all clients. …
Remediation	Vendor-released patch: upgrade to Apache ActiveMQ 6.2.7 (the 5.19.x branch should likewise be moved to 5.19.8, the fixed release for that line); the vendor explicitly recommends 6.2.7, per https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all ActiveMQ deployments running versions 5.19.7 or 6.2.6; assess whether brokers are network-accessible from untrusted sources. …

Threat intelligence, references, and detailed analysis are available after sign-in.