CVE-2026-39304

Overview

Apache ActiveMQ is a popular open-source messaging and Integration Patterns server maintained by the Apache Software Foundation. It supports a range of cross-language clients and wire protocols, including OpenWire, STOMP, AMQP 1.0 and MQTT, and fully supports JMS 1.1. Broker and client components are published as Maven artifacts under org.apache.activemq.

A denial of service vulnerability (CVE-2026-39304) has been identified in the ActiveMQ NIO SSL transports, which allows attackers to exhaust broker memory by rapidly triggering TLSv1.3 KeyUpdates on a connection. With TLSv1.2 and earlier, a handshake renegotiation causes the connection to hang instead.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of ActiveMQ.

‍

Details

Module Info

• Product: ActiveMQ
• Affected packages: org.apache.activemq:activemq-client, org.apache.activemq:activemq-broker, org.apache.activemq:activemq-all, org.apache.activemq:apache-activemq
• Affected versions: <5.19.5, >=6.0.0 <6.2.4
• GitHub repository: https://github.com/apache/activemq
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/activemq-client, https://central.sonatype.com/artifact/org.apache.activemq/activemq-broker, https://central.sonatype.com/artifact/org.apache.activemq/activemq-all, https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq
• Package manager: Maven
• Fixed in:
  • OSS ActiveMQ 5.19.5, 6.2.4
  • NES for ActiveMQ v5.16.10

Vulnerability Info

This High-severity vulnerability is found in the org.apache.activemq:activemq-client and org.apache.activemq:activemq-broker packages in multiple versions of ActiveMQ. The upstream announcement records the 5.x range as before 5.19.4, but 5.19.4 is also affected. 5.19.5 is the first 5.x release that contains the fix.

The NIO SSL transports, NIOSSLTransport in activemq-client and AutoInitNioSSLTransport in activemq-broker, read application data in a serviceRead() loop that decrypts incoming bytes through secureRead():

while (true) {
    //If the transport was already stopped then break
    if (this.isStopped()) {
        return;
    }

    if (!plain.hasRemaining()) {

        int readCount = secureRead(plain);

        if (readCount == 0) {
            break;
        }
        ...
    }

    if (status == SSLEngineResult.Status.OK && handshakeStatus != SSLEngineResult.HandshakeStatus.NEED_UNWRAP) {
        processCommand(plain);
    }
}

When a peer starts a handshake update on an established connection, such as a TLSv1.3 KeyUpdate or a TLSv1.2 renegotiation, secureRead() can return 0 bytes of application data while the SSLEngine reports a pending handshake status of NEED_WRAP, NEED_TASK or FINISHED. The loop treats a zero-byte read as "nothing left to do" and breaks without ever wrapping the handshake response, running the delegated tasks or refreshing the session, so the pending handshake state is never processed. A client that sends KeyUpdate messages in rapid succession causes this unprocessed state to accumulate inside the broker's SSLEngine until the broker runs out of memory, taking down every connection it serves. With TLSv1.2, the unanswered renegotiation leaves the connection hung. The NEED_UNWRAP guard on processCommand() can also skip plaintext that was already decrypted into the buffer while a handshake update is in flight. Any broker that exposes an NIO SSL transport (for example nio+ssl:// or auto+nio+ssl://) can be targeted by an unauthenticated network client.

‍

Mitigation

Only recent versions of ActiveMQ are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade ActiveMQ to a currently supported release line (5.19.x or 6.3.x) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.