CVE-2026-75880

Overview

Apache ActiveMQ Artemis is an open-source, high-performance message broker and the next-generation broker of the Apache ActiveMQ project. It provides asynchronous messaging with a non-blocking, journal-backed core and supports multiple wire protocols and APIs, including AMQP 1.0, MQTT, STOMP, OpenWire, and Jakarta Messaging (JMS). Broker and client components are published as Maven artifacts under org.apache.activemq through 2.44.0, and under org.apache.artemis from 2.50.0.

A regular expression denial of service (ReDoS) vulnerability (CVE-2026-75880) has been identified in the message selector support of Apache ActiveMQ Artemis, which allows authenticated attackers to exhaust broker CPU by attaching a consumer whose selector contains a crafted LIKE pattern. Each message delivery attempt against that consumer can occupy a shared broker thread for seconds or longer, delaying delivery to every other client served by the same thread.

Per OWASP: The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size).

This issue affects multiple versions of Apache ActiveMQ Artemis.

‍

Details

Module Info

• Product: Apache ActiveMQ Artemis
• Affected packages: org.apache.activemq:artemis-selector, org.apache.artemis:artemis-selector
• Affected versions:
  • org.apache.activemq:artemis-selector: >=1.0.0 <=2.44.0
  • org.apache.artemis:artemis-selector: >=2.50.0 <=2.56.0
• GitHub repository: https://github.com/apache/activemq-artemis
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/artemis-selector, https://central.sonatype.com/artifact/org.apache.artemis/artemis-selector
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Artemis 2.57.0
  • NES for Apache ActiveMQ Artemis v2.19.4

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.activemq:artemis-selector and org.apache.artemis:artemis-selector packages in multiple versions of Apache ActiveMQ Artemis. A selector is a JMS filter expression a consumer supplies when it attaches, which the broker parses once and then evaluates against every candidate message before deciding whether to deliver it. When the broker parses a selector such as prop LIKE '%a%a%a', the LikeExpression constructor in ComparisonExpression translates the JMS pattern into a java.util.regex pattern. Every % wildcard becomes a non-greedy .*?, the whole expression is anchored at both ends, and createLike() places no limit on how many wildcards a pattern may contain:

LikeExpression(Expression right, String like, int escape) {
   super(right);

   StringBuffer regexp = new StringBuffer(like.length() * 2);
   regexp.append("\\A"); // The beginning of the input
   for (int i = 0; i < like.length(); i++) {
      char c = like.charAt(i);
      if (escape == (0xFFFF & c) && shouldEscapeNext(like, i, c)) {
         i++;
         char t = like.charAt(i);
         regexp.append("\\x");
         regexp.append(Integer.toHexString(0xFFFF & t));
      } else {
         append(regexp, c);
      }
   }
   regexp.append("\\z"); // The end of the input

   likePattern = Pattern.compile(regexp.toString(), Pattern.DOTALL);
}

private void append(StringBuffer regexp, char c) {
   if (c == '%') {
      regexp.append(".*?"); // Do a non-greedy match
   } else if (c == '_') {
      regexp.append("."); // match one
   } else if (REGEXP_CONTROL_CHARS.contains(Character.valueOf(c))) {
      regexp.append("\\x");
      regexp.append(Integer.toHexString(0xFFFF & c));
   } else {
      regexp.append(c);
   }
}

A pattern like '%a%a%a%a%a%a%aZ' therefore compiles to \A.*?a.*?a.*?a.*?a.*?a.*?a.*?aZ\z. When the property value does not match, the regex engine backtracks through every way of dividing the value among the wildcards, so matching time grows with the length of the value raised to the number of wildcards. The match runs in LikeExpression.evaluate() each time the broker considers a message for the consumer, on the broker thread that performs delivery, so a single consumer with such a selector can stall delivery for other clients sharing that thread.

Any client permitted to create a consumer can supply a selector, so the attacker needs only valid credentials and consume permission on some queue or topic. Persisted durable subscriptions keep the selector across broker restarts. The flaw is in the artemis-selector jar, but artemis-server depends on it, so every broker, including one embedded through Spring Boot, carries the vulnerable code.

‍

Mitigation

Only recent versions of Apache ActiveMQ Artemis are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue.

Where upgrading is not immediately possible, grant consume permission only to trusted users, since any client allowed to attach a consumer can supply a selector.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache ActiveMQ Artemis to a currently supported release that contains the fix (2.57.0 or later), which upstream publishes under the org.apache.artemis groupId; no fixed release exists under org.apache.activemq.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Mike Read (finder)