EUVD-2026-75244
GHSA-c9m2-388v-p4rq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Authenticated network client triggers thread exhaustion remotely with no user interaction; impact is availability-only with no confidentiality or integrity loss.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Articles & Coverage 2
AnalysisAI
Denial of service in Apache ActiveMQ Artemis and Apache Artemis allows an authenticated client to exhaust shared broker thread resources by attaching a consumer with a crafted wildcard message selector that triggers excessive computational evaluation during message delivery. Affected versions span Apache ActiveMQ Artemis 1.0.0-2.44.0 and Apache Artemis 2.50.0-2.56.0, with a vendor-confirmed fix released in version 2.57.0 on September 9, 2026. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated connection to the Apache Artemis broker - the attacker must possess valid client credentials and be able to attach a consumer with a custom JMS message selector expression containing crafted wildcard usage. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The attack requires an authenticated client connection, which meaningfully reduces the threat surface compared to unauthenticated vulnerabilities - only parties with valid broker credentials can trigger the flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Artemis 2.57.0, which was released on September 9, 2026 and confirmed by both the oss-security advisory and the Apache Artemis project website to contain the fix for this issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache ActiveMQ Artemis deployments to identify systems running versions 1.0.0-2.44.0 or 2.50.0-2.56.0, and assess exposure by determining whether untrusted or less-privileged users can authenticate to affected brokers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today