Description
Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All.

A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done rapidly enough can lead to exhaustion of the NIO thread pool denying service to other connections.
This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8.

Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which fixes the issue.
Published: 2026-07-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper input validation that allows a remote unauthenticated peer to send a frame size value that bypasses negative frame size checks. The broker accepts a negative value, causing the NIO threads to terminate. Repeated execution exhausts the NIO thread pool, resulting in denial of service for all connections.

Affected Systems

The vulnerability affects Apache ActiveMQ AMQP before version 5.19.9 and from 6.0.0 before 6.2.8, Apache ActiveMQ before version 5.19.9 and from 6.0.0 before 6.2.8, and Apache ActiveMQ All before version 5.19.9 and from 6.0.0 before 6.2.8. Users should upgrade to version 5.19.9, 6.2.8, or 6.3.0 of the corresponding product line.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1 % suggests a low probability of exploitation at this time, and the issue is not listed in CISA KEV. Attackers only need to reach an open AMQP NIO connector and send a negative frame size value; no authentication is required to trigger the denial of service. Once the thread pool is exhausted, the broker will be unable to accept new connections until it is restarted or reconfigured.

Generated by OpenCVE AI on August 4, 2026 at 23:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch by upgrading to Apache ActiveMQ 5.19.9, 6.2.8, or 6.3.0, which contains a validation fix for the frame size field.
  • Configure firewall or access control rules to restrict inbound traffic to the AMQP NIO connector to known, trusted hosts, limiting exposure to unauthenticated peers.
  • Implement monitoring on the broker’s NIO thread pool usage and set alerts for abnormal spikes; consider enabling automatic restarts or scaling to recover from potential denial-of-service conditions.

Generated by OpenCVE AI on August 4, 2026 at 23:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache activemq
Apache activemq All
Apache activemq Amqp
Vendors & Products Apache
Apache activemq
Apache activemq All
Apache activemq Amqp

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done rapidly enough can lead to exhaustion of the NIO thread pool denying service to other connections. This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8. Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which fixes the issue.
Title Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Apache Activemq Activemq All Activemq Amqp
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-28T14:05:06.447Z

Reserved: 2026-07-07T16:19:11.276Z

Link: CVE-2026-59878

cve-icon Vulnrichment

Updated: 2026-07-28T13:37:49.195Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-28T14:16:38.283

Modified: 2026-08-05T18:46:44.583

Link: CVE-2026-59878

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T23:30:15Z

Weaknesses
  • CWE-20

    Improper Input Validation