CVE-2026-49362

CVE-2026-49362 is a missing-authentication flaw (CWE-306) in the CORE protocol handler of Apache ActiveMQ Artemis and Apache Artemis: the broker accepts CORE protocol commands without requiring any credentials. A remote attacker with network access to the broker's CORE acceptor (the default messaging port) can create arbitrary durable queues without authenticating, manipulating broker state without authorization. Because durable queues persist and consume broker resources, an attacker can repeatedly create queues to exhaust storage or memory and cause a denial of service; the queue creation itself also corrupts the intended broker configuration. All Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 and Apache Artemis versions 2.50.0 through 2.56.0 are affected. There is no CVSS score yet, no public proof-of-concept, and no known exploitation in the wild; the fix is available in version 2.57.0.

What to do: Upgrade to Apache Artemis/ActiveMQ Artemis 2.57.0, which fixes the issue. Until patched, restrict network access to the CORE protocol acceptor (the default broker messaging port) to trusted hosts and require authenticated, authorized users on acceptors, disabling anonymous access if present. Check whether brokers are reachable externally on the messaging port and review brokers for unexpected durable queues created without authentication.