ActiveMQ Unauthenticated Memory Exhaustion DoS Attack

CVE-2026-50734 exploits a critical validation gap in Apache ActiveMQ's WireFormatInfo frame handling during the pre-authentication negotiation phase. An unauthenticated network attacker can craft a malicious frame containing an excessively large size value that bypasses input validation, forcing the broker to attempt massive memory allocation before any authentication checks occur. This leads to Out-of-Memory (OOM) conditions that crash the broker, enabling denial-of-service attacks against organizations running vulnerable versions of ActiveMQ Client (before 5.19.8 or 6.0.0-6.2.7) and the broker itself. The attack is particularly dangerous because it requires no credentials and strikes during the initial connection handshake, making it trivial to weaponize at scale.

While CVE-2026-50734 maps to CWE-789 (Memory Allocation with Excessive Size Value) rather than discrete MITRE ATT&CK techniques, Casky's 754 mapped security skills enable practitioners to identify the underlying attack patterns through Claude's extended reasoning capabilities. The platform would flag reconnaissance activities probing for vulnerable ActiveMQ instances, followed by anomalous connection attempts with malformed WireFormatInfo frames. Practitioners would observe detection findings related to Resource Exhaustion tactics—specifically memory spike anomalies, unexpected broker terminations, and failed authentication negotiations with oversized payload requests. By correlating these signals with network telemetry and broker logs, security teams can distinguish legitimate connection failures from targeted exploitation attempts, enabling rapid containment before widespread DoS impact occurs.