Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-75880

Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Artemis

Default version status: unaffected

  • 2.50.0 to ≤ 2.56.0affected
pkg:maven/org.apache.artemis/artemis-selector

Apache Software Foundation Apache ActiveMQ Artemis

Default version status: unaffected

  • 1.0.0 to ≤ 2.44.0affected
pkg:maven/org.apache.activemq/artemis-selector

References