Following the fix for CVE-2026-49270, Apache ActiveMQ Broker versions 5.19.7 up to but not including 5.19.8, and 6.2.6 up to but not including 6.2.7, are vulnerable to a denial of service via out-of-memory condition. An unauthenticated attacker can repeatedly send BrokerInfo commands without sending a ConnectionInfo, causing the broker to consume excessive memory until it crashes. This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation results in denial of service by crashing the Apache ActiveMQ Broker due to out-of-memory conditions. There is no impact on confidentiality or integrity, but availability is severely affected, potentially disrupting messaging services relying on the broker.

A fix is available in Apache ActiveMQ Broker version 6.2.7. Users should upgrade to version 6.2.7 or later to remediate this vulnerability. No other mitigation or temporary workaround is indicated in the available data.