Executive brief
Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability has been identified where an authenticated user can crash the message broker by sending a specially crafted message that requests an excessive amount of memory. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and data flow between integrated systems.
Technical details
This vulnerability is a Memory Allocation with Excessive Size Value (CWE-789) issue within the OpenWire protocol implementation of Apache ActiveMQ. The root cause is a lack of size validation during the unmarshaling of OpenWire message property maps. An authenticated attacker can exploit this by sending a crafted OpenWire message containing a map with a large encoded size value, which forces the broker to attempt a massive memory allocation. This leads to an Out of Memory (OOM) error and subsequent broker crash. The issue is resolved in versions 5.19.8 and 6.2.7.
Affected products
- Apache Software Foundation ActiveMQ before 5.19.8, 6.0.0 to 6.2.7
- Apache Software Foundation ActiveMQ All before 5.19.8, 6.0.0 to 6.2.7
- Apache Software Foundation ActiveMQ Client before 5.19.8, 6.0.0 to 6.2.7
- Apache Software Foundation ActiveMQ Broker before 5.19.8, 6.0.0 to 6.2.7
Timeline
- 2026-06-30: advisory
- 2026-06-30: disclosed