An unauthenticated remote denial of service vulnerability exists in Apache ActiveMQ due to improper handling of TLSv1.3 handshakes, which can lead to total service exhaustion.

The vulnerability stems from the NIO SSL transport failing to correctly manage TLSv1.3 KeyUpdate messages. An unauthenticated attacker can send rapid KeyUpdate requests that exhaust the memory of the SSL engine, effectively crashing the broker.

The exploitation of this vulnerability results in a denial of service, rendering messaging services unavailable for legitimate business operations. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to the stability of enterprise infrastructure that relies on ActiveMQ for critical data transmission. Prolonged downtime can disrupt downstream applications and lead to severe operational bottlenecks.

Immediate Action: Upgrade all instances of Apache ActiveMQ Client, Broker, and the All distribution to version 5.19.4 or 6.2.4 immediately.

Proactive Monitoring: Monitor system memory usage and SSL handshake error logs for patterns of rapid, repetitive connection attempts or abnormal spikes in resource consumption.

Compensating Controls: Implement rate limiting on TLS connections at the network edge or via a load balancer to prevent an excessive volume of handshake requests from reaching the ActiveMQ broker.

Public Exploit Available: Unknown

This vulnerability represents a significant threat to service availability. Administrators should prioritize the deployment of the vendor-provided patches (versions 5.19.4 or 6.2.4) to address the underlying memory management defect. Ensure that all client-side libraries and broker components are updated in tandem to prevent potential compatibility issues and to ensure full protection against the described DoS vector.