# CVE-2026-53917: Apache ActiveMQ DoS via excessive memory allocation in OpenWire map unmarshaling Source: https://junglewise.ai/threats/cve-2026-53917-apache-activemq-dos-via-excessive-memory-allocation-in-openwire Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-06-30. Updated: 2026-06-30 License: CC BY 4.0 with a link back CVE-2026-53917 · Severity: high · CVSS 7.5 · Published 2026-06-30 Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability has been identified where an authenticated user can crash the message broker by sending a specially crafted message that requests an excessive amount of memory. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and data flow between integrated systems. Technologies: [Apache Software Foundation ActiveMQ All](https://junglewise.ai/threats/technologies/activemq-all), [Apache Software Foundation ActiveMQ Client](https://junglewise.ai/threats/technologies/activemq-client), [org.apache.activemq:activemq-all (Maven)](https://junglewise.ai/threats/technologies/org-apache-activemq-activemq-all), [org.apache.activemq:activemq-broker (Maven)](https://junglewise.ai/threats/technologies/org-apache-activemq-activemq-broker), [org.apache.activemq:activemq-client (Maven)](https://junglewise.ai/threats/technologies/org-apache-activemq-activemq-client), [org.apache.activemq:apache-activemq (Maven)](https://junglewise.ai/threats/technologies/org-apache-activemq-apache-activemq). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven). ## Quick answers **Is CVE-2026-53917 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53917 being exploited in the wild. **How severe is CVE-2026-53917?** High severity, with a CVSS score of 7.5, published 30 June 2026. **Which products and versions are affected?** Apache Software Foundation ActiveMQ All before 5.19.8, 6.0.0 to 6.2.7; Apache Software Foundation ActiveMQ Client before 5.19.8, 6.0.0 to 6.2.7; org.apache.activemq:activemq-all (Maven) < 5.19.8, ECOSYSTEM:introduced=0,fixed=5.19.8; org.apache.activemq:activemq-broker (Maven) < 5.19.8, ECOSYSTEM:introduced=0,fixed=5.19.8; and 2 more. **Is there a fix for CVE-2026-53917?** Yes. org.apache.activemq:activemq-all (Maven): upgrade to 5.19.8 or later; org.apache.activemq:activemq-broker (Maven): upgrade to 5.19.8 or later; org.apache.activemq:activemq-client (Maven): upgrade to 5.19.8 or later; org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-53917 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-53917?** Check whether you run Apache Software Foundation ActiveMQ All, Apache Software Foundation ActiveMQ Client, org.apache.activemq:activemq-all (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - org.apache.activemq:activemq-all (Maven): upgrade to 5.19.8 or later ```sh # set org.apache.activemq:activemq-all to 5.19.8 in your pom.xml or build.gradle ``` - org.apache.activemq:activemq-broker (Maven): upgrade to 5.19.8 or later ```sh # set org.apache.activemq:activemq-broker to 5.19.8 in your pom.xml or build.gradle ``` - org.apache.activemq:activemq-client (Maven): upgrade to 5.19.8 or later ```sh # set org.apache.activemq:activemq-client to 5.19.8 in your pom.xml or build.gradle ``` - org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.8 or later ```sh # set org.apache.activemq:apache-activemq to 5.19.8 in your pom.xml or build.gradle ``` ## Technical details This vulnerability is a Memory Allocation with Excessive Size Value (CWE-789) issue within the OpenWire protocol implementation of Apache ActiveMQ. The root cause is a lack of size validation during the unmarshaling of OpenWire message property maps. An authenticated attacker can exploit this by sending a crafted OpenWire message containing a map with a large encoded size value, which forces the broker to attempt a massive memory allocation. This leads to an Out of Memory (OOM) error and subsequent broker crash. The issue is resolved in versions 5.19.8 and 6.2.7. ## Affected products - Apache Software Foundation ActiveMQ before 5.19.8, 6.0.0 to 6.2.7 - Apache Software Foundation ActiveMQ All before 5.19.8, 6.0.0 to 6.2.7 - Apache Software Foundation ActiveMQ Client before 5.19.8, 6.0.0 to 6.2.7 - Apache Software Foundation ActiveMQ Broker before 5.19.8, 6.0.0 to 6.2.7 ## Identifiers - CVE-2026-53917 - BIT-ACTIVEMQ-2026-53917 - GHSA-f77w-px59-cqf5 ## Timeline - 2026-06-30: advisory - 2026-06-30: disclosed ## References - [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2) - [https://lists.apache.org/thread/grrd1mwgkgblqjbwkkq6dvmdxd9ov2dx](https://lists.apache.org/thread/grrd1mwgkgblqjbwkkq6dvmdxd9ov2dx) ## Related threats - [Apache ActiveMQ missing authorization in temporary destinations](https://junglewise.ai/threats/cve-2026-54475-apache-activemq-missing-authorization-in-temporary-destinations) - [Apache ActiveMQ denial of service via STOMP NIO heap exhaustion](https://junglewise.ai/threats/cve-2026-53916-apache-activemq-denial-of-service-via-stomp-nio-heap-exhaustion) - [Apache ActiveMQ stored XSS in Web Console browse page](https://junglewise.ai/threats/cve-2026-52760-apache-activemq-stored-xss-in-web-console-browse-page) - [Apache ActiveMQ Denial of Service via Out of Memory](https://junglewise.ai/threats/cve-2026-50750-apache-activemq-denial-of-service-via-out-of-memory) - [Apache ActiveMQ denial of service via excessive memory allocation](https://junglewise.ai/threats/cve-2026-50734-apache-activemq-denial-of-service-via-excessive-memory-allocation)