CVE-2026-75880: Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service
CVE-2026-75880: authenticated ActiveMQ Artemis clients can cause denial of service via crafted selector wildcard handling in affected versions.
An authenticated client can attach a consumer with a selector containing crafted wildcard usage, causing excessive evaluation during message delivery attempts that occupies a shared broker thread and leads to denial of service. Affected versions are Apache Artemis artemis-selector 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis artemis-selector 1.0.0 through 2.44.0. Apache rates the issue moderate.
- Authenticated clients can trigger broker denial of service via crafted selector wildcards.
- Affects artemis-selector 2.50.0-2.56.0 (Artemis) and 1.0.0-2.44.0 (ActiveMQ Artemis).
- Rated moderate by Apache.
- CVEs
- CVE-2026-75880
- Vendors
- Apache
- Products
- Apache ArtemisApache ActiveMQ
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75880 | Authenticated DoS via crafted wildcard message selectors in Apache ActiveMQ Artemis | 6.5 | <1% |
From the original article
Posted by Clebert Suconic on Sep 09 Severity: moderate Affected versions: - Apache Artemis (org. apache. artemis:artemis-selector) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.