Improper Check or Handling of Exceptional Conditions in ActiveMQ - CVE-2026-39304

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125791

Improper Check or Handling of Exceptional Conditions in ActiveMQ - CVE-2026-39304

Published: April 10, 2026


Vulnerability identifier: #VU125791
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-39304
CWE-ID: CWE-703
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of TLSv1.3 KeyUpdate messages in ActiveMQ NIO SSL transports when processing client-triggered TLSv1.3 handshake KeyUpdates. A remote attacker can rapidly trigger KeyUpdate messages to cause a denial of service.

Only TLSv1.3 is vulnerable to out-of-memory exhaustion; earlier TLS versions may cause a connection hang instead.


Affected software

ActiveMQ
IBM Sterling Secure Proxy
IBM Sterling Control Center
Bamboo Data Center
IBM Qradar SIEM
openEuler
activemq
activemq-javadoc

How to mitigate CVE-2026-39304

Install security update from vendor's website.

ActiveMQ - addressed in versions 5.19.5, 6.2.4
IBM Sterling Secure Proxy - update to 6.2.1.2.iFix02
IBM Sterling Control Center - addressed in versions 6.3.1.0.8, 6.4.1.0.2, 6.4.2.0.3
IBM Qradar SIEM - update to 7.5.0 Update Pack 15 IF05
Bamboo Data Center - addressed in versions 9.6.25, 10.2.18, 12.1.7
activemq - update to 5.19.6-1
activemq-javadoc - update to 5.19.6-1

External References

Related Security Bulletins