Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-39304

CVE-2026-39304: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-39304] Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM

    CVE-2026-39304Source published Source updated

    Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS. Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well. This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.…

    Affected products in this advisory
    • Apache ActiveMQ
    • Apache ActiveMQ Client
    • Apache ActiveMQ Broker
    • ActiveMQ
    Source-reported affected versions
    • Apache ActiveMQ Client before 5.19.4
    • Apache ActiveMQ Client 6.0.0 before 6.2.4
    • Apache ActiveMQ Broker before 5.19.4
    • Apache ActiveMQ Broker 6.0.0 before 6.2.4

    4 more entries in the full advisory.

    Source-reported fixed versions
    • 5.19.4
    • 6.2.4
    Mitigation guidance
    • Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-39304] Denial of Service due to TLSv1.3 KeyUpdate memory exhaustion

    CVE-2026-39304Source published

    Denial of Service due to TLSv1.3 KeyUpdate memory exhaustion. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released.

    Affected products in this advisory
    • Red Hat Fuse 7
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • Red Hat rates this important; a fix erratum may not be out yet — apply the RHSA as soon as it publishes.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features