{ "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.activemq:activemq-client", "purl": "pkg:maven/org.apache.activemq/activemq-client" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "5.19.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "5.10.0", "5.10.1", "5.10.2", "5.11.0", "5.11.1", "5.11.2", "5.11.3", "5.11.4", "5.12.0", "5.12.1", "5.12.2", "5.12.3", "5.13.0", "5.13.1", "5.13.2", "5.13.3", "5.13.4", "5.13.5", "5.14.0", "5.14.1", "5.14.2", "5.14.3", "5.14.4", "5.14.5", "5.15.0", "5.15.1", "5.15.10", "5.15.11", "5.15.12", "5.15.13", "5.15.14", "5.15.15", "5.15.16", "5.15.2", "5.15.3", "5.15.4", "5.15.5", "5.15.6", "5.15.7", "5.15.8", "5.15.9", "5.16.0", "5.16.1", "5.16.2", "5.16.3", "5.16.4", "5.16.5", "5.16.6", "5.16.7", "5.16.8", "5.17.0", "5.17.1", "5.17.2", "5.17.3", "5.17.4", "5.17.5", "5.17.6", "5.17.7", "5.18.0", "5.18.1", "5.18.2", "5.18.3", "5.18.4", "5.18.5", "5.18.6", "5.18.7", "5.19.0", "5.19.1", "5.19.2", "5.19.3", "5.19.4", "5.19.5", "5.19.6", "5.19.7", "5.8.0", "5.9.0", "5.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.activemq:activemq-client", "purl": "pkg:maven/org.apache.activemq/activemq-client" }, "ranges": [ { "events": [ { "introduced": "6.0.0" }, { "fixed": "6.2.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "6.0.0", "6.0.1", "6.1.0", "6.1.1", "6.1.2", "6.1.3", "6.1.4", "6.1.5", "6.1.6", "6.1.7", "6.1.8", "6.2.0", "6.2.1", "6.2.2", "6.2.3", "6.2.4", "6.2.5", "6.2.6" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.activemq:apache-activemq", "purl": "pkg:maven/org.apache.activemq/apache-activemq" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "5.19.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "4.1.1", "4.1.2", "5.0.0", "5.1.0", "5.10.0", "5.10.1", "5.10.2", "5.11.0", "5.11.1", "5.11.2", "5.11.3", "5.11.4", "5.12.0", "5.12.1", "5.12.2", "5.12.3", "5.13.0", "5.13.1", "5.13.2", "5.13.3", "5.13.4", "5.13.5", "5.14.0", "5.14.1", "5.14.2", "5.14.3", "5.14.4", "5.14.5", "5.15.0", "5.15.1", "5.15.10", "5.15.11", "5.15.12", "5.15.13", "5.15.14", "5.15.15", "5.15.16", "5.15.2", "5.15.3", "5.15.4", "5.15.5", "5.15.6", "5.15.7", "5.15.8", "5.15.9", "5.16.0", "5.16.1", "5.16.2", "5.16.3", "5.16.4", "5.16.5", "5.16.6", "5.16.7", "5.16.8", "5.17.0", "5.17.1", "5.17.2", "5.17.3", "5.17.4", "5.17.5", "5.17.6", "5.17.7", "5.18.0", "5.18.1", "5.18.2", "5.18.3", "5.18.4", "5.18.5", "5.18.6", "5.18.7", "5.19.0", "5.19.1", "5.19.2", "5.19.3", "5.19.4", "5.19.5", "5.19.6", "5.19.7", "5.2.0", "5.3.0", "5.3.1", "5.3.2", "5.4.0", "5.4.1", "5.4.2", "5.4.3", "5.5.0", "5.5.1", "5.6.0", "5.7.0", "5.8.0", "5.9.0", "5.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.activemq:apache-activemq", "purl": "pkg:maven/org.apache.activemq/apache-activemq" }, "ranges": [ { "events": [ { "introduced": "6.0.0" }, { "fixed": "6.2.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "6.0.0", "6.0.1", "6.1.0", "6.1.1", "6.1.2", "6.1.3", "6.1.4", "6.1.5", "6.1.6", "6.1.7", "6.1.8", "6.2.0", "6.2.1", "6.2.2", "6.2.3", "6.2.4", "6.2.5", "6.2.6" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.activemq:activemq-all", "purl": "pkg:maven/org.apache.activemq/activemq-all" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "5.19.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "4.1.2", "5.0.0", "5.1.0", "5.10.0", "5.10.1", "5.10.2", "5.11.0", "5.11.1", "5.11.2", "5.11.3", "5.11.4", "5.12.0", "5.12.1", "5.12.2", "5.12.3", "5.13.0", "5.13.1", "5.13.2", "5.13.3", "5.13.4", "5.13.5", "5.14.0", "5.14.1", "5.14.2", "5.14.3", "5.14.4", "5.14.5", "5.15.0", "5.15.1", "5.15.10", "5.15.11", "5.15.12", "5.15.13", "5.15.14", "5.15.15", "5.15.16", "5.15.2", "5.15.3", "5.15.4", "5.15.5", "5.15.6", "5.15.7", "5.15.8", "5.15.9", "5.16.0", "5.16.1", "5.16.2", "5.16.3", "5.16.4", "5.16.5", "5.16.6", "5.16.7", "5.16.8", "5.17.0", "5.17.1", "5.17.2", "5.17.3", "5.17.4", "5.17.5", "5.17.6", "5.17.7", "5.18.0", "5.18.1", "5.18.2", "5.18.3", "5.18.4", "5.18.5", "5.18.6", "5.18.7", "5.19.0", "5.19.1", "5.19.2", "5.19.3", "5.19.4", "5.19.5", "5.19.6", "5.19.7", "5.2.0", "5.3.0", "5.3.1", "5.3.2", "5.4.0", "5.4.1", "5.4.2", "5.4.3", "5.5.0", "5.5.1", "5.6.0", "5.7.0", "5.8.0", "5.9.0", "5.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.activemq:activemq-all", "purl": "pkg:maven/org.apache.activemq/activemq-all" }, "ranges": [ { "events": [ { "introduced": "6.0.0" }, { "fixed": "6.2.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "6.0.0", "6.0.1", "6.1.0", "6.1.1", "6.1.2", "6.1.3", "6.1.4", "6.1.5", "6.1.6", "6.1.7", "6.1.8", "6.2.0", "6.2.1", "6.2.2", "6.2.3", "6.2.4", "6.2.5", "6.2.6" ] } ], "aliases": [ "BIT-activemq-2026-50734", "CVE-2026-50734" ], "database_specific": { "cwe_ids": [ "CWE-789" ], "github_reviewed": true, "github_reviewed_at": "2026-11-04T15:59:56Z", "nvd_published_at": "2026-06-30T11:16:29Z", "severity": "HIGH" }, "details": "An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker.\nThis issue affects Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.", "id": "GHSA-7259-vf48-52q3", "modified": "2026-11-04T16:25:46.181028122Z", "published": "2026-06-30T12:31:52Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50734" }, { "type": "WEB", "url": "https://github.com/apache/activemq/pull/2080" }, { "type": "WEB", "url": "https://github.com/apache/activemq/commit/42e2be75eddcece3cddacf8a73e6cad7db5aa626" }, { "type": "WEB", "url": "https://github.com/apache/activemq/commit/6fc46e520bac7d9763ba5762cc2de603f19ed517" }, { "type": "WEB", "url": "https://github.com/apache/activemq/commit/e25f9b88898ef7cdfac9e855f4559a1ad0a6da12" }, { "type": "PACKAGE", "url": "https://github.com/apache/activemq" }, { "type": "WEB", "url": "https://github.com/apache/activemq/releases/tag/activemq-5.19.8" }, { "type": "WEB", "url": "https://github.com/apache/activemq/releases/tag/activemq-6.2.7" }, { "type": "WEB", "url": "https://lists.apache.org/thread/nxso951fnvf72qf9m475mpz4yf931xk0" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/06/29/10" } ], "schema_version": "1.9.2", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability" }