Executive brief
Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability exists where an unauthenticated attacker can send a specially crafted message to the system's network connector, causing the background processes that handle traffic to crash. If repeated, this can completely disable the messaging service, preventing legitimate business data from being processed and potentially disrupting integrated operations.
Technical details
An improper input validation vulnerability exists in the AMQP NIO connector of Apache ActiveMQ. A remote, unauthenticated attacker can send a malicious frame size value (specifically a negative or malformed value) that causes the Non-blocking I/O (NIO) threads to terminate unexpectedly. By rapidly sending these frames, an attacker can exhaust the NIO thread pool, leading to a complete denial-of-service for all incoming connections. The issue is fixed in versions 5.19.9, 6.2.8, and 6.3.0.
Affected products
- Apache ActiveMQ AMQP < 5.19.9, 6.0.0 to < 6.2.8
- Apache ActiveMQ < 5.19.9, 6.0.0 to < 6.2.8
- Apache ActiveMQ All < 5.19.9, 6.0.0 to < 6.2.8
Timeline
- 2026-07-27: disclosed: Initial disclosure on oss-security mailing list
- 2026-07-28: advisory: NVD publication date