Memory allocation with an excessive size value, a CWE-770 and CWE-789 vulnerability, allows an unauthenticated network attacker to trigger a broker denial of service by sending a crafted WireFormatInfo frame during pre‑authentication. The broker does not validate the size field and attempts to allocate that amount of memory, causing an out‑of‑memory condition that crashes the broker. The direct impact is the loss of availability of the broker, interrupting messaging services for all connected clients.

Apache ActiveMQ client and broker components from the Apache Software Foundation, including the 'Apache ActiveMQ All' bundle, are affected. Versions prior to 5.19.8 and versions 6.0.0 through 6.2.6 contain the vulnerability.

The vulnerability can be invoked by an attacker from any network location prior to authentication, making it widely exploitable. Although EPSS data is not available and the issue is not listed in the CISA KEV catalog, the nature of the flaw—pre‑authentication memory allocation—suggests a high impact on availability and a reasonable likelihood of exploitation. The CVSS score is 7.5, indicating significant severity, but the primary risk remains a broker crash rather than confidentiality or integrity compromise.