What is the CVSS score of CVE-2026-53916?

CVE-2026-53916 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Apache ActiveMQ are affected by CVE-2026-53916?

Apache ActiveMQ's STOMP protocol handler (versions 5.x pre-5.19.8 and 6.0.0-6.2.6) is vulnerable to unauthenticated remote denial of service through memory exhaustion attacks.. A patch is available.

How to fix or mitigate CVE-2026-53916?

Within 24 hours: Identify all ActiveMQ deployments and inventory versions; query for listeners on STOMP port 61613 or custom STOMP ports; classify each instance by business criticality. Within 7 days: Deploy firewall rules restricting STOMP port access to known, trusted internal clients and networks only; enable logging and alerting on STOMP connection attempts and broker error logs; document incident response procedures for broker restarts. Within 30 days: Monitor Apache ActiveMQ project advisories weekly (activemq.apache.org/security-advisories); evaluate message broker alternatives if available in your architecture; prepare and test emergency patching procedures to deploy within 48 hours once vendor releases a fix.

Apache ActiveMQ CVE-2026-53916

EUVD-2026-40278 HIGH

Memory Allocation with Excessive Size Value (CWE-789)

2026-06-29

GHSA-2q9g-8573-3265

Information Disclosure Apache Activemq Red Hat

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated STOMP connection with no complexity barrier; sole impact is complete availability loss via heap exhaustion; no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jun 30, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

Jun 30, 2026 - 17:22 NVD

7.5 (CRITICAL) 7.5 (HIGH)

Patch available

Jun 30, 2026 - 12:01 EUVD

Analysis Generated

Jun 29, 2026 - 22:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 5 New Apache Vulnerabilities - 2 Critical, 3 High Severity Jun 30, 2026 News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jun 30, 2026 News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jun 29, 2026 News Critical DoS via Heap Exhaustion in Apache ActiveMQ STOMP NIO - CVE-2026-53916 Jun 29, 2026

AnalysisAI

Unbounded heap consumption in Apache ActiveMQ's STOMP NIO codec allows an unauthenticated remote client to crash the broker by streaming non-terminating header bytes that the JVM buffers without limit until memory is exhausted. All three affected Maven artifacts (apache-activemq, activemq-all, activemq-stomp) are impacted in versions before 5.19.8 and in the 6.0.0-6.2.6 range. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated, low-complexity network attack surface against a widely-deployed enterprise broker makes this a credible denial-of-service risk for any deployment with an exposed STOMP port.

Technical ContextAI

Apache ActiveMQ is a Java-based open-source message broker implementing multiple transport protocols including STOMP (Simple Text Oriented Message Protocol). The vulnerability resides specifically in the NIO (Non-blocking I/O) codec for the STOMP transport, which is distinct from the broker's default blocking-I/O STOMP implementation. The root cause is a Memory Allocation with Excessive Size Value flaw (consistent with CWE-789): when a STOMP NIO connection is established and the client sends header bytes without a terminating frame delimiter, the codec continuously appends bytes to an internal buffer with no enforced size ceiling. This causes unbounded JVM heap growth until an OutOfMemoryError is thrown, crashing or fatally stalling the broker process. The three affected Maven coordinates are org.apache.activemq:apache-activemq, org.apache.activemq:activemq-all, and org.apache.activemq:activemq-stomp - covering both the standard distribution and the all-in-one and standalone STOMP packages.

RemediationAI

Upgrade to Apache ActiveMQ 6.2.7 for 6.x deployments or 5.19.8 for 5.x deployments; both releases were published June 29, 2026 and are available at https://activemq.apache.org/. If immediate patching is not feasible, restrict network access to the STOMP NIO port (default TCP 61613) via firewall rules or security groups to trusted client IP ranges only - this eliminates the unauthenticated remote attack surface but blocks all external STOMP clients. If the STOMP protocol is not required by any application, disable the STOMP transport connector entirely by removing or commenting out the corresponding transportConnector entry in activemq.xml; this eliminates the vulnerable code path entirely with no impact on AMQP, OpenWire, or MQTT clients. Note that JVM heap increases are not a compensating control - they delay but do not prevent exhaustion.