What is the CVSS score of EUVD-2026-40280?

EUVD-2026-40280 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Apache ActiveMQ are affected by EUVD-2026-40280?

Apache ActiveMQ versions 5.19.7 and 6.2.6 are vulnerable to unauthenticated remote denial of service attacks that crash the message broker by exhausting heap memory.. A patch is available.

How to fix or mitigate EUVD-2026-40280?

Within 24 hours: Identify all ActiveMQ deployments running versions 5.19.7 or 6.2.6; assess whether brokers are network-accessible from untrusted sources. Within 7 days: Deploy firewall rules restricting OpenWire protocol access (port 61616) to pre-approved internal networks only; configure connection rate limiting on affected brokers; enable heap memory monitoring with automated alerts. Within 30 days: Evaluate upgrade feasibility to unaffected ActiveMQ versions per vendor security guidance; if upgrades not viable, implement network segmentation isolating brokers behind restricted access controls.

Apache ActiveMQ EUVD-2026-40280

| CVE-2026-50750 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-30 apache

GHSA-9qj4-v6r6-3wmx

Denial Of Service Apache Red Hat Apache Activemq Broker Apache Activemq Apache Activemq All Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network attacker (AV:N, PR:N, UI:N) trivially repeats one command (AC:L); availability-only impact with broker OOM crash (A:H, C:N, I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jun 30, 2026 - 14:22 NVD

7.5 (HIGH)

Patch available

Jun 30, 2026 - 12:01 EUVD

Analysis Generated

Jun 30, 2026 - 11:15 vuln.today

DescriptionCVE.org

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.

Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Articles & Coverage 1

News 5 New Apache Vulnerabilities - 5 High Severity, No Public POC Jul 01, 2026

AnalysisAI

Remote denial of service in Apache ActiveMQ (versions 5.19.7 and 6.2.6) allows an unauthenticated attacker to exhaust broker heap memory and crash the service with an OutOfMemory error. The flaw is a regression introduced by the fix for CVE-2026-49270: an attacker repeatedly sends OpenWire BrokerInfo commands while never sending the expected ConnectionInfo, causing unbounded state accumulation until the broker dies. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network reachability makes it a credible availability threat to exposed brokers.

Technical ContextAI

Apache ActiveMQ is a widely used open-source Java message broker implementing JMS, with its native OpenWire protocol used for client-broker communication. In the OpenWire handshake, a client is expected to send a ConnectionInfo command to establish a connection context; here the broker accepts and processes repeated BrokerInfo commands without ever receiving the corresponding ConnectionInfo, so resources allocated per command are never bounded or released. The root cause is an uncontrolled resource consumption / unbounded memory allocation condition (CWE-400, Uncontrolled Resource Consumption, closely related to CWE-789 Memory Allocation with Excessive Size Value), arising from incomplete remediation of the earlier CVE-2026-49270. Affected CPEs are cpe:2.3:a:apache_software_foundation:apache_activemq_broker, apache_activemq, and apache_activemq_all.

RemediationAI

Vendor-released patch: upgrade to Apache ActiveMQ 6.2.7 (the 5.19.x branch should likewise be moved to 5.19.8, the fixed release for that line); the vendor explicitly recommends 6.2.7, per https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr. Where immediate patching is not possible, restrict network exposure of the OpenWire transport connector (default TCP 61616) so it is reachable only from trusted, authenticated clients via firewall rules or network segmentation, since the attack is unauthenticated and pre-connection - this is the most effective compensating control and has the side effect of blocking legitimate clients on untrusted networks. Additionally, place the broker behind authentication/TLS transport and consider lowering the JVM max heap exposure window by monitoring for abnormal BrokerInfo command volume, though these reduce rather than eliminate the OOM risk. Avoid relying on connection rate limiting alone, as a single source can send the repeated commands quickly.