CVE-2026-53917High· 7.5▾ TwilightApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.7%
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.
An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
org.apache.activemq:apache-activemq < 5.19.8org.apache.activemq:apache-activemq >= 6.0.0, < 6.2.7org.apache.activemq:activemq-all < 5.19.8org.apache.activemq:activemq-all >= 6.0.0, < 6.2.7org.apache.activemq:activemq-client < 5.19.8org.apache.activemq:activemq-client >= 6.0.0, < 6.2.7org.apache.activemq:activemq-broker < 5.19.8org.apache.activemq:activemq-broker >= 6.0.0, < 6.2.7Upgrade to a patched release:
org.apache.activemq:apache-activemq 5.19.8org.apache.activemq:apache-activemq 6.2.7org.apache.activemq:activemq-all 5.19.8org.apache.activemq:activemq-all 6.2.7org.apache.activemq:activemq-client 5.19.8org.apache.activemq:activemq-client 6.2.7org.apache.activemq:activemq-broker 5.19.8org.apache.activemq:activemq-broker 6.2.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49877High· 8.1Apache ActiveMQ Improper Authorization vulnerability
CVE-2026-50734High· 7.5Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability
CVE-2026-42440High· 7.5OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader Versions Affected: before 1.9.5 before 2.5.9 before 3.0.0-M3 Description: The AbstractModelReader methods getOutcomes(), getOutcomePatter…
CVE-2026-42528Medium· 4.3A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue
CVE-2026-92550High· 7.5A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to ve…
CVE-2026-43868Medium· 5.3Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.