PatchSiren cyber security CVE debrief

CVE-2026-39304 Apache Software Foundation CVE debrief

CVE-2026-39304 is a high-severity vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, and Apache ActiveMQ. The vulnerability is caused by the NIO SSL transports not correctly handling TLSv1.3 handshake KeyUpdates triggered by clients, leading to a Denial of Service (DoS) via Out of Memory. This issue affects Apache ActiveMQ Client, Apache ActiveMQ Broker, and Apache ActiveMQ versions before 5.19.4 and from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue. The CVSS score for this vulnerability is 7.5, indicating a high severity.

Vendor: Apache Software Foundation
Product: Apache ActiveMQ Client
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-04-10
Original CVE updated: 2026-07-15
Advisory published: 2026-04-10
Advisory updated: 2026-07-15

Who should care

Organizations using Apache ActiveMQ Client, Apache ActiveMQ Broker, or Apache ActiveMQ versions before 5.19.4 or from 6.0.0 before 6.2.4 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 6.2.4 or 5.19.5, which fixes the issue. Additionally, defenders should monitor their systems for potential exploitation attempts.

Technical summary

The vulnerability is caused by the NIO SSL transports not correctly handling TLSv1.3 handshake KeyUpdates triggered by clients. This leads to a Denial of Service (DoS) via Out of Memory. The issue affects Apache ActiveMQ Client, Apache ActiveMQ Broker, and Apache ActiveMQ versions before 5.19.4 and from 6.0.0 before 6.2.4. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a high severity. The weakness associated with this vulnerability is CWE-400 and CWE-770.

Defensive priority

High priority should be given to upgrading to version 6.2.4 or 5.19.5, which fixes the issue. Defenders should also monitor their systems for potential exploitation attempts.

Recommended defensive actions

Upgrade to version 6.2.4 or 5.19.5
Monitor systems for potential exploitation attempts
Review and update inventory of affected systems
Implement compensating controls to detect and prevent exploitation
Track exceptions and anomalies in system behavior

Evidence notes

The CVE-2026-39304 vulnerability was published on April 10, 2026, and modified on June 30, 2026. The vulnerability affects Apache ActiveMQ Client, Apache ActiveMQ Broker, and Apache ActiveMQ versions before 5.19.4 and from 6.0.0 before 6.2.4. The CVSS score for this vulnerability is 7.5, indicating a high severity.

Sources and references

Verified primary and authoritative sources

CVE-2026-39304 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-39304

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-39304 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39304

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://activemq.apache.org/security-advisories.data/CVE-2026-39304-announcement.txt

[email protected] - Vendor Advisory
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2026-39304

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39304.json

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.