What is the CVSS score of EUVD-2026-40277?

EUVD-2026-40277 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Apache ActiveMQ are affected by EUVD-2026-40277?

Apache ActiveMQ messaging brokers (versions prior to 5.19.8 and 6.0.x prior to 6.2.7) can be crashed by authenticated users, disrupting critical message-based communication in dependent systems.. A patch is available.

How to fix or mitigate EUVD-2026-40277?

Within 24 hours: Identify all Apache ActiveMQ deployments and document current versions running in your environment. Within 7 days: Test Apache ActiveMQ 5.19.8 (if running 5.x series) or 6.2.7 (if running 6.x series) in a non-production environment to ensure compatibility with dependent applications and configurations. Within 30 days: Deploy the patched versions to all production Apache ActiveMQ brokers using your standard change management process, verifying broker stability after upgrade.

Apache ActiveMQ EUVD-2026-40277

| CVE-2026-53917 HIGH

Memory Allocation with Excessive Size Value (CWE-789)

2026-06-29

GHSA-f77w-px59-cqf5

Denial Of Service Apache Activemq Activemq Broker Red Hat

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable OpenWire with low complexity, but the description requires an authenticated user so PR:L; impact is availability-only (A:H) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 15:32 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 15:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jun 30, 2026 - 12:01 EUVD

Analysis Generated

Jun 29, 2026 - 22:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 3

News 5 New Apache Vulnerabilities - 2 Critical, 3 High Severity Jun 30, 2026 News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jun 30, 2026 News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jun 29, 2026

AnalysisAI

Denial of service in Apache ActiveMQ (versions before 5.19.8, and 6.0.0 before 6.2.7) lets an authenticated user crash the broker by sending a crafted OpenWire message whose property map declares an excessively large encoded size. Because the map is unmarshaled without validating the declared size against actual payload bounds, the broker pre-allocates massive memory and hits an OutOfMemory condition. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the low attack complexity and availability of a vendor patch make it a practical operational concern for exposed brokers.

Technical ContextAI

Apache ActiveMQ is a widely used Java/JMS message broker, and the flaw lives in its native OpenWire wire protocol, the default high-performance binary transport used between clients and the broker (and the same code ships in the ActiveMQ Client, Broker, and 'All' distributions). OpenWire serializes message property maps as length-prefixed structures; the unmarshaling routine trusts the attacker-supplied encoded size field and allocates a buffer/collection sized to that value before reading the actual data. This is the classic CWE-789 (Memory Allocation with an Excessive Size Value) pattern: a single 4-byte size field can instruct the JVM to reserve gigabytes, exhausting heap and crashing the broker process before the undersized real payload is ever validated.

RemediationAI

Vendor-released patch: upgrade to 6.2.7 (for the 6.x line) or 5.19.8 (for the 5.x line), which add size validation during OpenWire map unmarshaling; this is the primary and recommended fix per the Apache advisory (https://activemq.apache.org/ and https://lists.apache.org/thread/grrd1mwgkgblqjbwkkq6dvmdxd9ov2dx). Where immediate upgrade is not possible, reduce exposure by restricting network access to the OpenWire transport port (default 61616) so only trusted application hosts can connect, and by requiring and tightly scoping broker authentication/authorization so anonymous or low-trust clients cannot submit messages - the trade-off is that locking down ACLs or firewalling the port may break legitimate producers/consumers and requires coordinated client reconfiguration. Constraining the JVM heap or running the broker under a process supervisor that auto-restarts limits downtime but does not prevent the crash itself.