Apache ActiveMQ Client/ActiveMQ Broker/ActiveMQ up to 5.19.3/6.2.3 TLS 1.3 KeyUpdate denial of service

Summaryinfo

A vulnerability was found in Apache ActiveMQ Client, ActiveMQ Broker and ActiveMQ up to 5.19.3/6.2.3. It has been classified as problematic. This vulnerability affects unknown code of the component TLS 1.3 KeyUpdate Handler. This manipulation causes denial of service. This vulnerability is tracked as CVE-2026-39304. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Apache ActiveMQ Client, ActiveMQ Broker and ActiveMQ up to 5.19.3/6.2.3 and classified as problematic. Affected by this vulnerability is an unknown code block of the component TLS 1.3 KeyUpdate Handler. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS. Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.

The advisory is shared at lists.apache.org. This vulnerability is known as CVE-2026-39304. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/02/2026). MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 305892 (Linux Distros Unpatched Vulnerability : CVE-2026-39304), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.19.4 or 6.2.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (305892). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• ActiveMQ
• ActiveMQ Broker
• ActiveMQ Client

Version

• 5.19.0
• 5.19.1
• 5.19.2
• 5.19.3
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion