Improper input validation allows an unauthenticated remote peer that can reach an exposed STOMP connector to send a frame with a negative content‑length value, immediately triggering denial‑of‑service behavior. In the NIO STOMP transport the server continues to read bytes and expands the per‑connection command buffer until it exceeds configured limits, resulting in an out‑of‑memory condition. In the blocking STOMP protocol, the invalid length causes an abnormal transport exception that forces the offending connection to be closed. The flaw is an instance of CWE‑20 and CWE‑839 and requires no authentication or privilege escalation to exploit.

Apache ActiveMQ and its variants—Apache ActiveMQ, Apache ActiveMQ All, and Apache ActiveMQ Stomp—running versions before 5.19.8 or from 6.0.0 up to but not including 6.2.7 are vulnerable.

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is a remote unauthenticated connection to the exposed STOMP port; no special privileges are required. An attacker can trigger the service to become unavailable by sending a negative content‑length, which either drains memory or closes connections, leading to service disruption. The exploit requires network access to the STOMP endpoint and the ability to send arbitrary frames.