EUVD-2026-40282
GHSA-7259-vf48-52q3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated single-frame trigger during pre-auth gives AV:N/AC:L/PR:N/UI:N; impact is broker crash only, so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.
An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Denial of service in Apache ActiveMQ (Client, broker, and All distributions) before 5.19.8 and 6.x before 6.2.7 lets a remote unauthenticated attacker crash the broker by sending a crafted WireFormatInfo frame containing an oversized size value during the pre-authentication protocol negotiation. Because the size is consumed before any authentication occurs, the broker attempts a massive memory allocation, triggering an out-of-memory condition and process crash. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the fix is shipped in 6.2.7 and 5.19.8.
Technical ContextAI
Apache ActiveMQ is a widely used Java-based open-source message broker implementing JMS and the OpenWire wire protocol. WireFormatInfo is the first OpenWire frame exchanged when a client connects, used to negotiate protocol version and marshalling options before authentication. The root cause is CWE-789 (Memory Allocation with Excessive Size Value): a length/size field embedded in the WireFormatInfo frame is trusted and used to size an allocation without validation against a sane upper bound. An attacker controlling that field can request an allocation far larger than available heap, exhausting the JVM heap and forcing an OutOfMemoryError that takes down the broker. The CPE data confirms three affected Apache Software Foundation packages: apache_activemq_client, apache_activemq, and apache_activemq_all.
RemediationAI
Vendor-released patch: upgrade to Apache ActiveMQ 6.2.7 (for the 6.x line) or 5.19.8 (for the 5.x line), per the Apache advisory at https://lists.apache.org/thread/nxso951fnvf72qf9m475mpz4yf931xk0, which add validation of the WireFormatInfo size value. Where immediate patching is not possible, reduce exposure by restricting network access to the OpenWire transport (default TCP port 61616) using firewall rules or network segmentation so only trusted clients can reach the broker, accepting that this breaks connectivity for any legitimate clients outside the allowed set. If supported in your deployment, lowering the OpenWire maxFrameSize / wire-format limits on the transport connector can cap attacker-controllable allocation sizes, with the trade-off that legitimately large messages may be rejected. Because the flaw is triggered pre-authentication, transport-level authentication alone will not prevent it - network-level access control is the key compensating control until the upgrade is applied.
More in Apache Activemq Client
View allOut-of-memory denial of service in Apache ActiveMQ allows unauthenticated remote attackers to exhaust broker memory via
Improper path validation in Apache ActiveMQ Client and Broker allows authenticated users to traverse the classpath via c
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today