CVE-2026-75880— Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service
Quick assessment
Affected
Apache Software Foundation Apache Artemis
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Artemis是美国Apache基金会开源的一款支持多种消息协议的高性能消息代理软件。 Apache Artemis 2.50.0版本至2.56.0版本和Apache ActiveMQ Artemis 1.0.0版本至2.44.0版本存在资源管理错误漏洞，该漏洞源于经过身份验证的客户端可附加带有特制通配符用法的选择器消费者，导致消息传递期间过度评估，占用共享代理线程，可能造成拒绝服务。
Possible ATT&CK Techniques 1 AI
T1298Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache ActiveMQ Artemis | 1.0.0≤ 2.44.0 |
affected |
| Apache Software Foundation | Apache Artemis | 2.50.0≤ 2.56.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75880
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Artemis 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Artemis是美国Apache基金会开源的一款支持多种消息协议的高性能消息代理软件。 Apache Artemis 2.50.0版本至2.56.0版本和Apache ActiveMQ Artemis 1.0.0版本至2.44.0版本存在资源管理错误漏洞，该漏洞源于经过身份验证的客户端可附加带有特制通配符用法的选择器消费者，导致消息传递期间过度评估，占用共享代理线程，可能造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Artemis | 2.50.0 ~ 2.56.0 | - |
|
| Apache Software Foundation | Apache ActiveMQ Artemis | 1.0.0 ~ 2.44.0 | - |
|
II. Public POCs for CVE-2026-75880
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75880
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-75880 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-10 · 11 CVEs total
| CVE-2026-80354 | Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secr | |
| CVE-2026-80351 | Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod | |
| CVE-2026-80352 | Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author appl | |
| CVE-2026-84939 | Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path trave | |
| CVE-2026-49362 | Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler A | |
| CVE-2026-49363 | Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE | |
| CVE-2026-49364 | Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Auth | |
| CVE-2026-57822 | Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserializatio | |
| CVE-2026-57967 | Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session r | |
| CVE-2026-67593 | Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-auth |
IV. Related Vulnerabilities
Same product: Apache Artemis
-
CVE-2026-49362
Apache Artemis, Apache ActiveMQ Artemis: Missing Authenticat -
CVE-2026-49363
Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication -
CVE-2026-49364
Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apa -
CVE-2026-57822
Apache Artemis, Apache ActiveMQ Artemis: Message-based manag -
CVE-2026-57967
Apache Artemis, Apache ActiveMQ Artemis: Missing authenticat
Same vendor: Apache Software Foundation
-
CVE-2026-73322
Apache Pinot: Incorrect authorization in the single-stage qu -
CVE-2026-64618
Apache Fineract: SQL injection vulnerability in Search API -
CVE-2026-65874
Apache Fineract: SQL injection via ORDER BY parameters in th -
CVE-2026-71569
Apache Camel: Camel-A2A Push Notification Webhook Guard Acce -
CVE-2026-115942
Apache Qpid Proton C: Verifying non compliant TLS wildcard c
Same weakness: CWE-1333
-
CVE-2026-62864
Ring's nested-params middleware has inefficient regular expr -
CVE-2026-119300
Wekan: ReDoS via Unescaped User Input in RegExp -
CVE-2026-118993
CallBackery versions before 0.62.0 for Perl allow denial of -
CVE-2026-115866
Starlet versions from 0.20 before 0.33 for Perl allow CPU ex -
CVE-2026-119202
@hapi/content: quadratic-time parsing of Content-Disposition