Executive brief
Apache ActiveMQ, a widely used message broker for enterprise applications, is vulnerable to a denial-of-service attack. An unauthenticated remote attacker can send specially crafted messages to the STOMP connector to crash the service or exhaust its memory. This could lead to a complete disruption of message processing and communication between integrated business systems.
Technical details
An improper input validation vulnerability exists in the STOMP protocol implementation of Apache ActiveMQ. A remote unauthenticated attacker can reach an exposed STOMP connector and trigger denial-of-service behavior by providing a negative 'content-length' value. In the NIO STOMP transport, this allows an attacker to stream body bytes that grow the per-connection command buffer beyond configured limits, resulting in an Out-of-Memory (OOM) crash. In the blocking STOMP protocol, the error triggers abnormal transport exception handling that forces connection closure. The issue is resolved in versions 6.2.7 and 5.19.8.
Affected products
- Apache Software Foundation Apache ActiveMQ before 5.19.8, 6.0.0 to 6.2.7
- Apache Software Foundation Apache ActiveMQ All before 5.19.8, 6.0.0 to 6.2.7
- Apache Software Foundation Apache ActiveMQ Stomp before 5.19.8, 6.0.0 to 6.2.7
Timeline
- 2026-06-30: advisory
- 2026-06-30: disclosed