Memory Exhaustion in Apache ActiveMQ Products Due to TLSv1.3 Handshake Issues

CVE-2026-39304

What is CVE-2026-39304?

An Out of Memory vulnerability has been identified in Apache ActiveMQ products due to improper handling of TLSv1.3 handshake KeyUpdates initiated by clients. This flaw allows a client to rapidly trigger these updates, leading to exhausting memory resources in the SSL engine of the broker, resulting in a Denial of Service condition. Notably, prior versions of TLS (like TLSv1.2) experience different issues, such as connection hangs, but are not susceptible to Out of Memory errors. Apache strongly recommends upgrading to versions 6.2.4 or 5.19.5 to mitigate this issue.

References