CVE-2026-39304 Details
Description
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS. Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.
A denial-of-service vulnerability causing out-of-memory conditions has been identified in Apache ActiveMQ Client, Apache ActiveMQ Broker, and Apache ActiveMQ All. This issue arises in the NIO SSL transports, which improperly manage TLSv1.3 handshake KeyUpdates initiated by clients. As a result, a client can quickly trigger these updates, leading the broker to deplete its memory resources in the SSL engine, causing a denial-of-service condition. Notably, TLS versions prior to 1.3, such as TLSv1.2, exhibit similar issues but do not result in out-of-memory conditions. Instead, they require a complete handshake renegotiation, causing connections to hang without consuming additional memory. This vulnerability affects Apache ActiveMQ Client versions prior to 5.19.4 and 6.0.0 versions prior to 6.2.4, as well as Apache ActiveMQ Broker and Apache ActiveMQ All under the same version conditions.
Users are advised to upgrade to Apache ActiveMQ versions 6.2.4 or 5.19.5, both of which address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-39304 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2457275 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39304.json | redhat-SADP | |
| http://www.openwall.com/lists/oss-security/2026/04/09/17 | CVE | Mailing ListThird Party Advisory |
| https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
| CWE-770 | Allocation of Resources Without Limits or Throttling | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| apache activemq | < 5.19.4 >= 6.0.0, < 6.2.4 |
CPE
Remediation
| |
| apache activemq broker | < 5.19.4 >= 6.0.0, < 6.2.4 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 10, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | CVE Modified | CVE |
| Apr 10, 2026 | New CVE Received | [email protected] |