CVE-2026-75880

MediumCVSS 6.5/10Last modified Sep 18, 2026

Description

An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service.

This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.57.0, which fixes this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Artemis	>= 2.50.0, <= 2.56.0
Apache Software Foundation	Apache ActiveMQ Artemis	>= 1.0.0, <= 2.44.0

References

https://lists.apache.org/thread/db34g9qoxd8p08086cr95683fkb8wm5rMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/10/7Mailing List, Third Party Advisory

Timeline

Published: Sep 10, 2026
Last modified: Sep 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-758817.5IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an in CVE-2026-758828.5An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permiss CVE-2026-758836.8A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specia CVE-2026-758849.1A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccoun CVE-2026-758859.3A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remo CVE-2026-758867.2A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks CVE-2026-758877.5A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` CVE-2026-758887.7A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by p CVE-2026-758897.7Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched n CVE-2026-75895.3A vulnerability was determined in ghantakiran splunk-mcp-integration up to 0b86b09d5e5adf0433acd43c975951224613a1a6. Impacted is the functio CVE-2026-758918.8The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 vi CVE-2026-758926.5In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-fiel