« Volver al listado

CVE-2026-75880

Estado: AnalizadaMedia (6.5)—

An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service.

This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.57.0, which fixes this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Artemis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-75880",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-75880",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-10T17:31:34.370541Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Artemis",
          "versions": [
            {
              "status": "affected",
              "version": "2.50.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.56.0"
            }
          ],
          "packageURL": "pkg:maven/org.apache.artemis/artemis-selector",
          "packageName": "org.apache.artemis:artemis-selector",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ Artemis",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.44.0"
            }
          ],
          "packageURL": "pkg:maven/org.apache.activemq/artemis-selector",
          "packageName": "org.apache.activemq:artemis-selector",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-10T05:17:01.673",
  "references": [
    {
      "url": "https://lists.apache.org/thread/db34g9qoxd8p08086cr95683fkb8wm5r",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/09/10/7",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service.\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes this issue."
    }
  ],
  "lastModified": "2026-09-18T15:17:11.787",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6E3F972-3247-4504-AFD9-833891228040",
              "versionEndExcluding": "2.44.0",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A41D89AC-2573-4270-9C7C-21D85E1096FE",
              "versionEndExcluding": "2.57.0",
              "versionStartIncluding": "2.50.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}