Executive brief
Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability in how it handles initial connection requests allows an unauthenticated attacker to crash the service by forcing it to exhaust its available memory. This results in a denial-of-service (DoS) condition, disrupting message delivery and business operations that rely on the broker.
Technical details
A Memory Allocation with Excessive Size Value vulnerability (CWE-789) exists in the Apache ActiveMQ broker. The flaw is located in the handling of WireFormatInfo frames during the pre-authentication negotiation phase. An unauthenticated remote attacker can send a crafted frame containing a malicious, large size value that the broker fails to validate. This causes the broker to attempt a massive memory allocation, leading to an Out-of-Memory (OOM) error and a subsequent process crash. The issue is resolved in versions 5.19.8 and 6.2.7.
Affected products
- Apache ActiveMQ Client before 5.19.8, 6.0.0 to 6.2.6
- Apache ActiveMQ before 5.19.8, 6.0.0 to 6.2.6
- Apache ActiveMQ All before 5.19.8, 6.0.0 to 6.2.6
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory