CVE-2026-49432High· 7.5▾ TwilightApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.8%
Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
org.apache.activemq:apache-activemq < 5.19.8org.apache.activemq:apache-activemq >= 6.0.0, < 6.2.7org.apache.activemq:activemq-all < 5.19.8org.apache.activemq:activemq-all >= 6.0.0, < 6.2.7org.apache.activemq:activemq-stomp < 5.19.8org.apache.activemq:activemq-stomp >= 6.0.0, < 6.2.7Upgrade to a patched release:
org.apache.activemq:apache-activemq 5.19.8org.apache.activemq:apache-activemq 6.2.7org.apache.activemq:activemq-all 5.19.8org.apache.activemq:activemq-all 6.2.7org.apache.activemq:activemq-stomp 5.19.8org.apache.activemq:activemq-stomp 6.2.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-52760Medium· 6.1Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting
CVE-2026-49877High· 8.1Apache ActiveMQ Improper Authorization vulnerability
CVE-2026-53917High· 7.5Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability
CVE-2026-108946NoneApache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
CVE-2026-111821NoneApache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
CVE-2026-111822NoneApache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation