# CVE-2026-53916: Apache ActiveMQ denial of service via STOMP NIO heap exhaustion

Source: https://junglewise.ai/threats/cve-2026-53916-apache-activemq-denial-of-service-via-stomp-nio-heap-exhaustion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-53916 · Severity: info · CVSS 0 · Published 2026-06-30

Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different applications. A vulnerability has been identified where an unauthenticated attacker can send specially crafted data that causes the system to consume all available memory. This results in a denial-of-service condition, making the messaging service unavailable and potentially crashing the entire application environment.

Technologies: [Apache Software Foundation ActiveMQ All](https://junglewise.ai/threats/technologies/activemq-all). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-53916 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53916 being exploited in the wild.

**How severe is CVE-2026-53916?** Informational severity, with a CVSS score of 0, published 30 June 2026.

**Which products and versions are affected?** Apache Software Foundation ActiveMQ All before 5.19.8, 6.0.0 to 6.2.7; Apache Software Foundation ActiveMQ Stomp before 5.19.8, 6.0.0 to 6.2.7.

**Is there a fix for CVE-2026-53916?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53916 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53916?** Check whether you run Apache Software Foundation ActiveMQ All or Apache Software Foundation ActiveMQ Stomp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Memory Allocation with Excessive Size Value vulnerability (CWE-789) exists in the STOMP NIO implementation of Apache ActiveMQ. An unauthenticated client can open a STOMP NIO connection and transmit header bytes that never terminate. Because the broker buffers these bytes without a defined limit, it eventually exhausts the Java Virtual Machine (JVM) heap memory. The vulnerability affects versions prior to 5.19.8 and the 6.x branch prior to 6.2.7. Users should upgrade to versions 6.2.7 or 5.19.8 to resolve the issue.

## Affected products

- Apache Software Foundation Apache ActiveMQ before 5.19.8, 6.0.0 to 6.2.7
- Apache Software Foundation Apache ActiveMQ All before 5.19.8, 6.0.0 to 6.2.7
- Apache Software Foundation Apache ActiveMQ Stomp before 5.19.8, 6.0.0 to 6.2.7

## Timeline

- 2026-06-30: advisory
- 2026-06-30: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/07hjsj88hqgsb7vvg6ttsj56ts9vjs5n](https://lists.apache.org/thread/07hjsj88hqgsb7vvg6ttsj56ts9vjs5n)

## Related threats

- [Apache ActiveMQ missing authorization in temporary destinations](https://junglewise.ai/threats/cve-2026-54475-apache-activemq-missing-authorization-in-temporary-destinations)
- [Apache ActiveMQ DoS via excessive memory allocation in OpenWire map unmarshaling](https://junglewise.ai/threats/cve-2026-53917-apache-activemq-dos-via-excessive-memory-allocation-in-openwire)
- [Apache ActiveMQ denial of service via excessive memory allocation](https://junglewise.ai/threats/cve-2026-50734-apache-activemq-denial-of-service-via-excessive-memory-allocation)
- [Apache ActiveMQ information disclosure in durable subscriptions](https://junglewise.ai/threats/cve-2026-49270-apache-activemq-information-disclosure-in-durable-subscriptions)
- [Apache ActiveMQ DoS via memory exhaustion in NIO SSL transport](https://junglewise.ai/threats/cve-2026-39304-apache-activemq-dos-via-memory-exhaustion-in-nio-ssl-transport)