Skip to content
VulniPulse
Sign in
Advisory severityHigh7.5Red Hat Linux

High [CVE-2026-50734] Denial of Service via crafted WireFormatInfo frame

This high-severity Red Hat Linux advisory covers CVE-2026-50734 affecting AMQ Clients 2026.Q3, Red Hat AMQ Broker 7.13.6, Red Hat AMQ Broker 7.14.1.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-50734 Source published Source updated

VulniPulse record published Record updated

CVE-2026-50734
Affected products & platforms
Red Hat LinuxUnclassified
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value.

The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Consequently, this can lead to an Out Of Memory (OOM) error, resulting in a Denial of Service (DoS) and crashing the broker. A flaw was found in Apache ActiveMQ Classic's OpenWire protocol handling.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.

Affected Red Hat products: AMQ Clients 2026.Q3; Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat AMQ Broker 7; Red Hat AMQ Clients; Red Hat Fuse 7; Red Hat Single Sign-On 7.

Red Hat lists Red Hat build of Apache Camel for Spring Boot 4; Red Hat Data Grid 8; Red Hat Enterprise Linux 8; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat Satellite 6 as not affected. Will not fix / out of support: Red Hat Fuse 7.

Red Hat fixing advisory: RHSA-2026:69459, RHSA-2026:66545, RHSA-2026:66488.

Affected versions
  • < 5.19.8
  • < 6.0.0
  • < 6.2.7

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Fixed versions
  • 6.2.7
  • 5.19.8
  • artemis-core-client
  • activemq-client
  • RHSA-2026:69459
  • RHSA-2026:66545
  • RHSA-2026:66488

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.