CVE-2026-75880

Apache ActiveMQ Artemis fails to bound the evaluation cost of message selectors, so a selector with crafted wildcard usage can trigger excessive processing (CWE-1333) each time the broker attempts message delivery. An authenticated client triggers it by attaching a consumer whose selector contains the crafted wildcards, and each delivery attempt then occupies a shared broker thread for a disproportionate amount of time. By sustaining this load (with one or more such consumers), the attacker can tie up broker threads and stall or degrade message delivery for other clients, achieving denial of service with no privilege escalation or data exposure. All users running Apache Artemis 2.50.0 through 2.56.0 or Apache ActiveMQ Artemis 1.0.0 through 2.44.0 are affected, which in practice covers essentially every Artemis release before 2.57.0 across standalone and embedded broker deployments. The flaw has no CVSS score yet, no known public proof-of-concept, is not listed in CISA KEV, and there are no known reports of exploitation in the wild.

What to do: Upgrade to Apache Artemis 2.57.0, the fix version cited in the advisory. As an interim measure, restrict broker access to trusted authenticated clients and review consumer configurations that use wildcard-heavy selectors, since valid credentials are required to trigger the flaw. Until a CVSS score is published, prioritize patching internet-reachable or multi-tenant brokers where authenticated clients could saturate delivery threads.