Executive brief
Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different applications. A vulnerability has been identified where an unauthenticated attacker can send specially crafted data that causes the system to consume all available memory. This results in a denial-of-service condition, making the messaging service unavailable and potentially crashing the entire application environment.
Technical details
A Memory Allocation with Excessive Size Value vulnerability (CWE-789) exists in the STOMP NIO implementation of Apache ActiveMQ. An unauthenticated client can open a STOMP NIO connection and transmit header bytes that never terminate. Because the broker buffers these bytes without a defined limit, it eventually exhausts the Java Virtual Machine (JVM) heap memory. The vulnerability affects versions prior to 5.19.8 and the 6.x branch prior to 6.2.7. Users should upgrade to versions 6.2.7 or 5.19.8 to resolve the issue.
Affected products
- Apache Software Foundation Apache ActiveMQ before 5.19.8, 6.0.0 to 6.2.7
- Apache Software Foundation Apache ActiveMQ All before 5.19.8, 6.0.0 to 6.2.7
- Apache Software Foundation Apache ActiveMQ Stomp before 5.19.8, 6.0.0 to 6.2.7
Timeline
- 2026-06-30: advisory
- 2026-06-30: disclosed