Apache ActiveMQ, Apache ActiveMQ All, and Apache ActiveMQ Stomp are vulnerable to a denial of service trigger when a remote, unauthenticated peer connects to an exposed STOMP connector and sends a frame with a negative content‑length value. This negative length causes the server to incorrectly handle the payload: the NIO STOMP transport keeps consuming the network stream, enlarging the per‑connection command buffer until it exceeds the configured limits and results in out‑of‑memory conditions, while the blocking STOMP protocol forces abnormal transport exception handling, leading to premature connection shutdown. The vulnerability is an instance of improper input validation (CWE‑20).

The affected products are Apache ActiveMQ, Apache ActiveMQ All, and Apache ActiveMQ Stomp. Versions before 5.19.8 and all releases in the 6.0.0 to 6.2.6 range are impacted; upgrading to 5.19.8 or 6.2.7 removes the flaw.

The CVSS score is 7.5, indicating a high severity. The EPSS score is not available, but the vulnerability allows an unauthenticated attacker to trigger service disruption by sending a frame with a negative content‑length to an exposed STOMP connector. This can cause OOM in the NIO transport or abnormal exception handling in the blocking protocol, resulting in a denial of service. The flaw is not listed in the CISA KEV catalog, and the attack can be carried out over any network where the STOMP port is reachable.