Loading vulnerability…
Out-of-memory DoS in Apache ActiveMQ NIO SSL transport TLSv1.3 KeyUpdate handling
CVE-2026-39304 is a denial-of-service vulnerability in Apache ActiveMQ affecting the Client, Broker, All, and Apache ActiveMQ distributions. The flaw is in the NIO SSL transport's handling of TLSv1.3 handshake KeyUpdate messages. A client can rapidly trigger KeyUpdate events, and the vulnerable broker does not correctly process them, causing memory exhaustion in the SSL engine and ultimately an out-of-memory condition. Apache also noted related broken handling for pre-TLSv1.3 renegotiation paths such as TLSv1.2; those cases can cause connections to hang but do not produce the same out-of-memory condition. Affected versions are ActiveMQ 5.x before 5.19.4 and 6.x from 6.0.0 before 6.2.4.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote client can cause the broker to exhaust available memory in the SSL engine, leading to an out-of-memory condition and denial of service. Successful exploitation can disrupt broker availability and terminate or destabilize message-processing services that depend on the affected ActiveMQ instance. For TLS versions prior to 1.3, the related bug can cause connection hangs rather than memory exhaustion.
If you can’t patch tonight, do this now.
Apply the vendor fix by upgrading affected ActiveMQ components to 6.2.4 or 5.19.5. No specific alternative workaround is provided in the advisory. Where immediate patching is not possible, reducing exposure of NIO SSL broker endpoints to untrusted clients may reduce risk, but the provided content does not document an official mitigation beyond upgrading.
Patch, then assume compromise.
Upgrade Apache ActiveMQ to a fixed release. The advisory recommends upgrading to version 6.2.4 or 5.19.5, which contain the fix for the TLS KeyUpdate handling issue and the related pre-TLSv1.3 handshake handling problem.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.