What is the CVSS score of CVE-2026-49432?

CVE-2026-49432 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Apache ActiveMQ are affected by CVE-2026-49432?

Apache ActiveMQ STOMP connectors contain a high-severity remote denial-of-service vulnerability enabling attackers with network access to STOMP ports to crash the broker or exhaust memory, affecting…. A patch is available.

How to fix or mitigate CVE-2026-49432?

24 hours: Identify all ActiveMQ instances running affected versions (pre-5.19.8 or 6.0.0-6.2.6); implement firewall rules to restrict STOMP port access (default TCP 5672) to internal authorized systems. 7 days: Configure ActiveMQ per-connection memory and buffer limits; enable broker monitoring to establish baseline resource utilization and alert on anomalies. 30 days: Monitor Apache ActiveMQ advisories for patches to versions 5.19.8+, 6.2.7+, or later; plan and execute upgrades to patched versions within 90 days of availability.

Apache ActiveMQ CVE-2026-49432

EUVD-2026-40284 HIGH

Improper Input Validation (CWE-20)

2026-06-30 apache

GHSA-xjwq-9jw5-jf7w

Apache Information Disclosure Red Hat Apache Activemq Apache Activemq All Apache Activemq Stomp Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated peer triggers DoS over the network with a simple malformed header (AV:N/AC:L/PR:N/UI:N); impact is availability-only via OOM/connection teardown, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 30, 2026 - 12:01 EUVD

Analysis Generated

Jun 30, 2026 - 11:17 vuln.today

DescriptionCVE.org

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.

A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Articles & Coverage 1

News 5 New Apache Vulnerabilities - 5 High Severity, No Public POC Jul 01, 2026

AnalysisAI

Denial-of-service in Apache ActiveMQ STOMP connectors lets a remote peer that can reach an exposed STOMP port crash or exhaust the broker by sending a negative content-length value. On the NIO STOMP transport the attacker streams body bytes to grow the per-connection command buffer past configured limits and force an out-of-memory condition, while the blocking STOMP transport instead throws an abnormal transport exception that closes the affected connection. The flaw affects ActiveMQ, ActiveMQ All, and ActiveMQ Stomp before 5.19.8 and the 6.0.0-6.2.6 line; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Apache ActiveMQ is a widely used open-source JMS message broker, and STOMP (Simple Text Oriented Messaging Protocol) is one of its wire protocols, typically exposed on a dedicated connector (default port 61613). The vulnerability is a CWE-20 Improper Input Validation issue in how the STOMP frame parser handles the content-length header: a negative value is not rejected, so the length-based framing logic misbehaves. On the non-blocking NIO STOMP transport this lets an attacker keep feeding body bytes that accumulate in the per-connection command buffer beyond the configured maximum, driving JVM heap exhaustion; on the legacy blocking STOMP transport the same malformed length triggers an unhandled transport exception path that abnormally tears down the connection. Both ActiveMQ All (the uber-distribution) and the standalone ActiveMQ Stomp module share the affected parsing code.

RemediationAI

Vendor-released patch: upgrade to Apache ActiveMQ 6.2.7 (for the 6.x line) or 5.19.8 (for the 5.x line), which fix the improper validation of the STOMP content-length header; the same fixed versions apply to the ActiveMQ All and ActiveMQ Stomp distributions, per the Apache advisory at https://lists.apache.org/thread/fsjb26605syqr8xks249h8gkp86t55d2. If immediate patching is not possible, reduce exposure by disabling the STOMP connector entirely if it is not in use, or by firewalling/restricting the STOMP port (default 61613) so it is reachable only from trusted message-producing hosts rather than the public internet - the trade-off is that legitimate remote STOMP clients on untrusted networks will lose connectivity. Where feasible, place the broker behind a network proxy or load balancer that can enforce sane frame/size limits and front the connector with TLS and client authentication to limit who can open STOMP sessions; this adds operational overhead and does not fully eliminate the parsing flaw, so it is a stopgap until the upgrade is applied.