CVE-2026-39304

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39304
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39304.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39304
Aliases
Downstream
Related
Published
2026-04-10T10:54:04.130Z
Modified
2026-07-08T08:12:59.836525760Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM
Details

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "5.19.4"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.4"
                },
                {
                    "fixed": "5.19.4"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.4"
                },
                {
                    "fixed": "5.19.4"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.4"
                },
                {
                    "fixed": "5.19.4"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.4"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "TLSv1.3"
                },
                {
                    "fixed": "5.19.4"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.4"
                },
                {
                    "fixed": "5.19.4"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.4"
                },
                {
                    "fixed": "5.19.4"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.4"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39304.json",
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/activemq

Affected ranges

Type
GIT
Repo
https://github.com/apache/activemq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2c1b9eefa68c684083478bfa4a9bcf42892f33ec
Introduced
14bac13f40958c1a1d3d198051eed32facc4abd1
Fixed
6bb0a02efa1efa4b325e6970f30a629cd8618e72
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.19.4"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.2.4"
        }
    ]
}

Affected versions

activemq-5.*
activemq-5.10.0
activemq-5.11.0
activemq-5.12.0
activemq-5.13.0
activemq-5.14.0
activemq-5.15.0
activemq-5.16.0
activemq-5.18.0
activemq-5.18.1
activemq-5.18.2
activemq-5.18.3
activemq-5.18.4
activemq-5.18.5
activemq-5.18.6
activemq-5.19.0
activemq-5.19.1
activemq-5.19.2
activemq-5.9.0
activemq-6.*
activemq-6.0.0
activemq-6.1.0
activemq-6.1.1
activemq-6.1.2
activemq-6.2.0
activemq-6.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39304.json"