AI analysis
CVE-2026-49362 is a missing-authentication flaw (CWE-306) in the CORE protocol handler of Apache ActiveMQ Artemis and Apache Artemis: the broker accepts CORE protocol commands without requiring any credentials. A remote attacker with network access to the broker's CORE acceptor (the default messaging port) can create arbitrary durable queues without authenticating, manipulating broker state without authorization. Because durable queues persist and consume broker resources, an attacker can repeatedly create queues to exhaust storage or memory and cause a denial of service; the queue creation itself also corrupts the intended broker configuration. All Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 and Apache Artemis versions 2.50.0 through 2.56.0 are affected. There is no CVSS score yet, no public proof-of-concept, and no known exploitation in the wild; the fix is available in version 2.57.0.
What to do: Upgrade to Apache Artemis/ActiveMQ Artemis 2.57.0, which fixes the issue. Until patched, restrict network access to the CORE protocol acceptor (the default broker messaging port) to trusted hosts and require authenticated, authorized users on acceptors, disabling anonymous access if present. Check whether brokers are reachable externally on the messaging port and review brokers for unexpected durable queues created without authentication.
Affected
| Apache ActiveMQ Artemis | 1.0.0 through 2.44.0 (inclusive) |
| Apache Artemis | 2.50.0 through 2.56.0 (inclusive) |
Estimated exposure
largelikely tens of thousands of broker deployments worldwide, with thousands to tens of thousands internet-exposed on the messaging port — ActiveMQ Artemis is the successor broker used in Red Hat AMQ and deployed widely as standalone or embedded enterprise messaging, and public internet scans of broker listeners such as port 61616 show thousands of ActiveMQ-family brokers…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.