{"id":"CVE-2026-50750","revision":null,"records":[{"revision":"98a4c0c8561a4e67bfd0f09690da3a31","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-50750","aliases":[],"title":"Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270","description":"Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nFollowing the fix for  CVE-2026-49270\u00A0an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending\u00A0a ConnectionInfo, until the broker will crash with OOM.\nThis issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7, which fixes the issue.","state":0,"publishedAt":"2026-06-30T09:51:57.035+00:00","modifiedAt":"2026-06-30T13:21:45.456+00:00","affected":[{"ecosystem":"https://repo.maven.apache.org/maven2","name":"org.apache.activemq:activemq-broker","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://repo.maven.apache.org/maven2\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"org.apache.activemq:activemq-broker\",\n                    \"product\": \"Apache ActiveMQ Broker\",\n                    \"vendor\": \"Apache Software Foundation\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"5.19.8\",\n                            \"status\": \"affected\",\n                            \"version\": \"5.19.7\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"6.2.7\",\n                            \"status\": \"affected\",\n                            \"version\": \"6.2.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://repo.maven.apache.org/maven2","name":"org.apache.activemq:apache-activemq","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://repo.maven.apache.org/maven2\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"org.apache.activemq:apache-activemq\",\n                    \"product\": \"Apache ActiveMQ\",\n                    \"vendor\": \"Apache Software Foundation\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"5.19.8\",\n                            \"status\": \"affected\",\n                            \"version\": \"5.19.7\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"6.2.7\",\n                            \"status\": \"affected\",\n                            \"version\": \"6.2.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://repo.maven.apache.org/maven2","name":"org.apache.activemq:activemq-all","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://repo.maven.apache.org/maven2\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"org.apache.activemq:activemq-all\",\n                    \"product\": \"Apache ActiveMQ All\",\n                    \"vendor\": \"Apache Software Foundation\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"5.19.8\",\n                            \"status\": \"affected\",\n                            \"version\": \"5.19.7\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"6.2.7\",\n                            \"status\": \"affected\",\n                            \"version\": \"6.2.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://lists.apache.org/thread/nhkmbdym61yp6wwy0dny8w1p46sm87kr"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-50750","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-50750","identifiers":["CVE-2026-50750"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T10:13:07.6997575+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T10:13:07.6997575+00:00","lastSuccessAt":"2026-10-26T10:13:07.8601918+00:00","error":null,"lastVerifiedAt":"2026-10-26T10:13:07.8601939+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-2ce4e71b5c377952ee822301ac3737abb16ddc46e7e170572868997851a0ce5b","complete":true,"records":414122,"lastAttemptAt":"2026-10-26T10:13:06.6299129+00:00","lastSuccessAt":"2026-10-26T10:13:06.5969582+00:00","error":null,"lastVerifiedAt":"2026-10-26T10:13:06.6299129+00:00","snapshotPublishedAt":"2026-10-26T09:37:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T10:13:10.3623005+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T10:13:07.6997575+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T10:13:07.6997575+00:00","lastSuccessAt":"2026-10-26T10:13:07.8614935+00:00","error":null,"lastVerifiedAt":"2026-10-26T10:13:07.8614941+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-26T10:13:08.4268574+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T10:13:07.2730799+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T10:13:07.2730799+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T10:13:06.7795329+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T10:13:06.7795329+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-26T10:13:07.6589842+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-26T10:13:07.6589842+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-654e90fb44abcd729ddecf56d54c1b46ce87ca3181850e8bc65d5c8befceb659","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T10:13:07.1710504+00:00","lastSuccessAt":"2026-10-26T08:22:30.1390577+00:00","error":null,"lastVerifiedAt":"2026-10-26T10:13:07.1710504+00:00","snapshotPublishedAt":"2026-10-26T07:48:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}