{"id":"GHSA-5568-6qcg-g7fx","summary":" Apache ActiveMQ: Denial of Service via Out of Memory vulnerability","details":"Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.\n\nActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.\n\nNote: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well.\nThis issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.\n\nUsers are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.","aliases":["BIT-activemq-2026-39304","CVE-2026-39304"],"modified":"2026-09-10T03:50:43.215311840Z","published":"2026-04-10T12:31:44Z","database_specific":{"cwe_ids":["CWE-400"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-04-10T21:01:01Z","nvd_published_at":"2026-04-10T11:16:23Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39304"},{"type":"WEB","url":"https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt"},{"type":"PACKAGE","url":"https://github.com/apache/activemq"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/04/09/17"}],"affected":[{"package":{"name":"org.apache.activemq:activemq-client","ecosystem":"Maven","purl":"pkg:maven/org.apache.activemq/activemq-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.4"}]}],"versions":["5.10.0","5.10.1","5.10.2","5.11.0","5.11.1","5.11.2","5.11.3","5.11.4","5.12.0","5.12.1","5.12.2","5.12.3","5.13.0","5.13.1","5.13.2","5.13.3","5.13.4","5.13.5","5.14.0","5.14.1","5.14.2","5.14.3","5.14.4","5.14.5","5.15.0","5.15.1","5.15.10","5.15.11","5.15.12","5.15.13","5.15.14","5.15.15","5.15.16","5.15.2","5.15.3","5.15.4","5.15.5","5.15.6","5.15.7","5.15.8","5.15.9","5.16.0","5.16.1","5.16.2","5.16.3","5.16.4","5.16.5","5.16.6","5.16.7","5.16.8","5.17.0","5.17.1","5.17.2","5.17.3","5.17.4","5.17.5","5.17.6","5.17.7","5.18.0","5.18.1","5.18.2","5.18.3","5.18.4","5.18.5","5.18.6","5.18.7","5.19.0","5.19.1","5.19.2","5.19.3","5.8.0","5.9.0","5.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5568-6qcg-g7fx/GHSA-5568-6qcg-g7fx.json"}},{"package":{"name":"org.apache.activemq:activemq-client","ecosystem":"Maven","purl":"pkg:maven/org.apache.activemq/activemq-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.4"}]}],"versions":["6.0.0","6.0.1","6.1.0","6.1.1","6.1.2","6.1.3","6.1.4","6.1.5","6.1.6","6.1.7","6.1.8","6.2.0","6.2.1","6.2.2","6.2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5568-6qcg-g7fx/GHSA-5568-6qcg-g7fx.json"}},{"package":{"name":"org.apache.activemq:activemq-broker","ecosystem":"Maven","purl":"pkg:maven/org.apache.activemq/activemq-broker"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.4"}]}],"versions":["5.10.0","5.10.1","5.10.2","5.11.0","5.11.1","5.11.2","5.11.3","5.11.4","5.12.0","5.12.1","5.12.2","5.12.3","5.13.0","5.13.1","5.13.2","5.13.3","5.13.4","5.13.5","5.14.0","5.14.1","5.14.2","5.14.3","5.14.4","5.14.5","5.15.0","5.15.1","5.15.10","5.15.11","5.15.12","5.15.13","5.15.14","5.15.15","5.15.16","5.15.2","5.15.3","5.15.4","5.15.5","5.15.6","5.15.7","5.15.8","5.15.9","5.16.0","5.16.1","5.16.2","5.16.3","5.16.4","5.16.5","5.16.6","5.16.7","5.16.8","5.17.0","5.17.1","5.17.2","5.17.3","5.17.4","5.17.5","5.17.6","5.17.7","5.18.0","5.18.1","5.18.2","5.18.3","5.18.4","5.18.5","5.18.6","5.18.7","5.19.0","5.19.1","5.19.2","5.19.3","5.8.0","5.9.0","5.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5568-6qcg-g7fx/GHSA-5568-6qcg-g7fx.json"}},{"package":{"name":"org.apache.activemq:activemq-broker","ecosystem":"Maven","purl":"pkg:maven/org.apache.activemq/activemq-broker"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.4"}]}],"versions":["6.0.0","6.0.1","6.1.0","6.1.1","6.1.2","6.1.3","6.1.4","6.1.5","6.1.6","6.1.7","6.1.8","6.2.0","6.2.1","6.2.2","6.2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5568-6qcg-g7fx/GHSA-5568-6qcg-g7fx.json"}},{"package":{"name":"org.apache.activemq:activemq-all","ecosystem":"Maven","purl":"pkg:maven/org.apache.activemq/activemq-all"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.4"}]}],"versions":["4.1.2","5.0.0","5.1.0","5.10.0","5.10.1","5.10.2","5.11.0","5.11.1","5.11.2","5.11.3","5.11.4","5.12.0","5.12.1","5.12.2","5.12.3","5.13.0","5.13.1","5.13.2","5.13.3","5.13.4","5.13.5","5.14.0","5.14.1","5.14.2","5.14.3","5.14.4","5.14.5","5.15.0","5.15.1","5.15.10","5.15.11","5.15.12","5.15.13","5.15.14","5.15.15","5.15.16","5.15.2","5.15.3","5.15.4","5.15.5","5.15.6","5.15.7","5.15.8","5.15.9","5.16.0","5.16.1","5.16.2","5.16.3","5.16.4","5.16.5","5.16.6","5.16.7","5.16.8","5.17.0","5.17.1","5.17.2","5.17.3","5.17.4","5.17.5","5.17.6","5.17.7","5.18.0","5.18.1","5.18.2","5.18.3","5.18.4","5.18.5","5.18.6","5.18.7","5.19.0","5.19.1","5.19.2","5.19.3","5.2.0","5.3.0","5.3.1","5.3.2","5.4.0","5.4.1","5.4.2","5.4.3","5.5.0","5.5.1","5.6.0","5.7.0","5.8.0","5.9.0","5.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5568-6qcg-g7fx/GHSA-5568-6qcg-g7fx.json"}},{"package":{"name":"org.apache.activemq:activemq-all","ecosystem":"Maven","purl":"pkg:maven/org.apache.activemq/activemq-all"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.4"}]}],"versions":["6.0.0","6.0.1","6.1.0","6.1.1","6.1.2","6.1.3","6.1.4","6.1.5","6.1.6","6.1.7","6.1.8","6.2.0","6.2.1","6.2.2","6.2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5568-6qcg-g7fx/GHSA-5568-6qcg-g7fx.json"}},{"package":{"name":"org.apache.activemq:apache-activemq","ecosystem":"Maven","purl":"pkg:maven/org.apache.activemq/apache-activemq"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.4"}]}],"versions":["4.1.1","4.1.2","5.0.0","5.1.0","5.10.0","5.10.1","5.10.2","5.11.0","5.11.1","5.11.2","5.11.3","5.11.4","5.12.0","5.12.1","5.12.2","5.12.3","5.13.0","5.13.1","5.13.2","5.13.3","5.13.4","5.13.5","5.14.0","5.14.1","5.14.2","5.14.3","5.14.4","5.14.5","5.15.0","5.15.1","5.15.10","5.15.11","5.15.12","5.15.13","5.15.14","5.15.15","5.15.16","5.15.2","5.15.3","5.15.4","5.15.5","5.15.6","5.15.7","5.15.8","5.15.9","5.16.0","5.16.1","5.16.2","5.16.3","5.16.4","5.16.5","5.16.6","5.16.7","5.16.8","5.17.0","5.17.1","5.17.2","5.17.3","5.17.4","5.17.5","5.17.6","5.17.7","5.18.0","5.18.1","5.18.2","5.18.3","5.18.4","5.18.5","5.18.6","5.18.7","5.19.0","5.19.1","5.19.2","5.19.3","5.2.0","5.3.0","5.3.1","5.3.2","5.4.0","5.4.1","5.4.2","5.4.3","5.5.0","5.5.1","5.6.0","5.7.0","5.8.0","5.9.0","5.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5568-6qcg-g7fx/GHSA-5568-6qcg-g7fx.json"}},{"package":{"name":"org.apache.activemq:apache-activemq","ecosystem":"Maven","purl":"pkg:maven/org.apache.activemq/apache-activemq"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.4"}]}],"versions":["6.0.0","6.0.1","6.1.0","6.1.1","6.1.2","6.1.3","6.1.4","6.1.5","6.1.6","6.1.7","6.1.8","6.2.0","6.2.1","6.2.2","6.2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5568-6qcg-g7fx/GHSA-5568-6qcg-g7fx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}