What is the CVSS score of EUVD-2026-49848?

EUVD-2026-49848 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Is there a patch available for EUVD-2026-49848?

Yes, a patch is available for EUVD-2026-49848. Update the affected software to the latest version immediately.

Apache ActiveMQ EUVD-2026-49848

| CVE-2026-59878 HIGH

Improper Input Validation (CWE-20)

2026-07-27

GHSA-4mq2-fjvq-8232

Apache Information Disclosure Activemq Activemq All Activemq Amqp

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated attack with low complexity causes high availability impact, no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 28, 2026 - 15:02 EUVD

Analysis Generated

Jul 27, 2026 - 18:16 vuln.today

CVE Published

Jul 27, 2026 - 17:27 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Denial of service in Apache ActiveMQ's AMQP NIO connector allows remote unauthenticated attackers to exhaust the NIO thread pool by sending a crafted negative frame size value, causing legitimate connection disruption. Affects ActiveMQ versions before 5.19.9 and 6.x before 6.2.8. No known active exploitation, but rated moderate by the vendor due to network exposure.

Technical ContextAI

The vulnerability stems from improper input validation (CWE-20) in the AMQP protocol implementation over NIO transport. When an AMQP NIO connector processes an incoming frame, lack of proper validation for negative frame sizes leads to immediate thread death, and repeated malicious frames can exhaust the limited NIO thread pool. This affects the activemq-amqp module and the bundled activemq-all distribution, as indicated by CPE strings for org.apache.activemq:activemq-amqp, org.apache.activemq:apache-activemq, and org.apache.activemq:activemq-all.

RemediationAI

Upgrade to Apache ActiveMQ 5.19.9, 6.2.8, or 6.3.0, which contain the fix. If patching is not immediately possible, restrict network access to the AMQP NIO connector (default port 5671) to trusted hosts using firewall rules, or disable the AMQP transport if not required. Note that blocking AMQP may disrupt messaging integrations relying on that protocol.