CVE-2026-49432: Apache ActiveMQ STOMP Denial of Service via Negative Content-Length

Technical summary

CVE-2026-49432 is an improper input validation vulnerability (CWE-20) affecting Apache ActiveMQ's STOMP protocol handler. The vulnerability stems from insufficient validation of the Content-Length header, which permits negative values. On NIO STOMP transports, this enables an attacker to bypass buffer limits by continuously streaming body bytes, causing the per-connection command buffer to grow unboundedly and triggering out-of-memory conditions. On blocking STOMP transports, malformed input triggers abnormal exception handling that terminates the connection. The vulnerability requires network-level access to an exposed STOMP connector but no authentication credentials. CVSS v3.1 score is 7.5 (High), reflecting high availability impact with low attack complexity.

Business impact

An attacker can remotely disable ActiveMQ broker instances, disrupting message queuing and any applications dependent on the broker. In environments where ActiveMQ is central to event processing, order management, or asynchronous workflows, this can cascade into broader system outages. Recovery requires manual broker restart, creating operational friction and potential message loss if persistence is misconfigured. Organizations exposing STOMP connectors to untrusted networks face elevated risk.

Affected systems

Apache ActiveMQ versions before 5.19.8 and from 6.0.0 through 6.2.6 are vulnerable. The issue affects all three named components: Apache ActiveMQ (core), Apache ActiveMQ All (bundled distribution), and Apache ActiveMQ Stomp (STOMP protocol module). Both NIO and blocking STOMP transport implementations are affected, though with different manifestations. No other Apache message broker products or unrelated third-party software are impacted.

Exploitability

Exploitability is high. The attack requires only network connectivity to the STOMP port—no authentication, no user interaction, and no special privileges. Sending a crafted STOMP frame with a negative Content-Length header is trivial; any network tool or custom script suffices. The vulnerability is likely to be exploited quickly once public details emerge, especially in environments with STOMP connectors exposed to the internet or untrusted networks. Mitigation through network segmentation is feasible for some deployments but not a substitute for patching.

Remediation

Upgrade to Apache ActiveMQ 5.19.8, 6.2.7, or later. These releases add proper input validation for the Content-Length header, rejecting negative or malformed values before buffer operations commence. Organizations unable to patch immediately should restrict network access to STOMP connectors (default port 61613) to trusted hosts only, ideally via firewall or VPN. Disable STOMP if it is not actively used. Monitor broker logs for sudden connection closures and memory pressure spikes, which may signal exploit attempts.

Patch guidance

Verify the patch version against the official Apache ActiveMQ release notes and security advisory. For version 5.x deployments, target 5.19.8 or later. For version 6.x, target 6.2.7 or later. Test patches in a staging environment first to confirm compatibility with deployed applications. Plan patching during maintenance windows when possible, as broker restart is typically required. If running a bundled ActiveMQ All distribution, ensure the entire bundle is updated to guarantee the STOMP module patch is applied.

Detection guidance

Look for failed or abnormal STOMP connections in ActiveMQ broker logs, particularly those closed immediately after connection establishment or with memory-related errors. Network traffic analysis can identify repeated STOMP frames with invalid Content-Length headers from untrusted sources. Monitor JVM heap usage for sudden spikes correlated with new inbound connections on port 61613. Intrusion detection rules can flag STOMP packets with negative or oversized Content-Length values. Baseline normal STOMP traffic first to reduce false positives.

Why prioritize this

This vulnerability should be prioritized for immediate patching in any environment where ActiveMQ is exposed to untrusted networks or where broker availability is critical to business operations. The high CVSS score (7.5), trivial attack complexity, and lack of authentication barriers make it attractive to opportunistic attackers. While not currently flagged in CISA's KEV catalog, public exploitation is anticipated once researcher details are released. Organizations with internet-facing or multi-tenant STOMP connectors should treat this as urgent.

Risk score, explained

The CVSS v3.1 score of 7.5 reflects a network-exploitable vulnerability with no access controls, resulting in total availability loss (denial of service). The attack vector (AV:N), no privilege requirement (PR:N), and lack of user interaction (UI:N) maximize likelihood of exploitation. The impact is limited to availability (A:H) with no confidentiality or integrity impact, preventing a critical rating. The score is appropriate and conservative; in environments where broker uptime directly impacts revenue or critical services, the business risk may exceed the technical score.

Frequently asked questions