Vulnerability · Published Sep 10, 2026 · Assigned by apache
CVE-2026-75880Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service
Medium 6.5
In plain English
A medium-severity regular-expression denial of service in Apache ActiveMQ Artemis from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities).
Official description
An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Artemis | 2.50.0 – through 2.56.0 |
| Apache Software Foundation | Apache ActiveMQ Artemis | 1.0.0 – through 2.44.0 |
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H