Apache ActiveMQ Artemis EUVD-2026-75244

Exploitation requires an authenticated connection to the Apache Artemis broker - the attacker must possess valid client credentials and be able to attach a consumer with a custom JMS message selector expression containing crafted wildcard usage. The selector feature is standard JMS functionality enabled by default; no special non-default configuration is needed. Limiting factors include: the authentication requirement (PR:L), which excludes unauthenticated attackers; environments that restrict broker access to fully trusted internal services reduce exposure; and the impact is limited to availability (no confidentiality or integrity loss). The broad affected range for ActiveMQ Artemis (1.0.0 through 2.44.0) means that any standard deployment of these versions with client-accessible selector support is exposed.

The attack requires an authenticated client connection, which meaningfully reduces the threat surface compared to unauthenticated vulnerabilities - only parties with valid broker credentials can trigger the flaw. However, in practice many messaging deployments grant authenticated access broadly to application clients, development teams, or multi-tenant consumers, meaning the authentication bar may be low. Thread pool exhaustion on a shared broker is a genuine service-level impact, capable of degrading or halting message delivery for all broker consumers and producers simultaneously, not just the attacker's queue. The Apache security team's 'moderate' designation is consistent with the authenticated trigger and availability-only impact. No CVSS vector, EPSS score, or CISA KEV status was provided in the source data, making quantitative risk comparison impossible - severity is assessed qualitatively. The broad version range for ActiveMQ Artemis (1.0.0 through 2.44.0) suggests many installations may be running older versions that are long out of date and thus affected. No public exploit code or active exploitation has been identified at time of analysis.

An authenticated messaging client connects to a vulnerable Artemis broker and attaches a consumer to a queue or topic, supplying a JMS message selector string containing a specially crafted wildcard pattern. When the broker evaluates this selector against incoming messages during delivery, the wildcard evaluation enters an excessive computation loop, monopolizing one or more threads from the shared broker thread pool. Repeating this across multiple consumers or triggering frequent message delivery attempts causes thread pool exhaustion, rendering the broker unresponsive to all other clients.