CVE-2026-53917: Apache ActiveMQ Memory Allocation DoS Vulnerability

Technical summary

CVE-2026-53917 is a memory allocation vulnerability in ActiveMQ's OpenWire protocol message handling, specifically in the unmarshaling of property maps. The vulnerability stems from insufficient input validation on the encoded size field of map objects before memory allocation occurs. An attacker with broker credentials can construct an OpenWire message with a size value far exceeding the actual payload, causing the JVM to attempt allocation of excessive memory. This triggers an out-of-memory condition (OOM) that crashes the broker process. The vulnerability is rooted in CWE-789 (Memory Allocation with Excessive Size Value).

Business impact

Availability of message-oriented applications becomes unreliable. ActiveMQ brokers are often central to enterprise messaging infrastructure, supporting order processing, event streaming, and integration workflows. An authenticated attacker can repeatedly crash these brokers, causing service disruption. Recovery requires manual intervention and restart. In environments where brokers are not properly isolated or monitored, an insider or compromised application account can degrade or halt dependent systems. The impact is particularly severe for organizations running single-broker deployments without clustering or redundancy.

Affected systems

The vulnerability affects four product variants: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, and Apache ActiveMQ Broker. Vulnerable versions include all 5.x releases prior to 5.19.8 and all 6.x releases from 6.0.0 up to and including 6.2.6. Version 6.2.7 and 5.19.8 contain the fix. Organizations should inventory their ActiveMQ deployments and verify version numbers against this range.

Exploitability

Exploitation requires valid broker credentials (authentication is required), which limits the attack surface to insiders, applications with broker access, or accounts compromised through other means. No advanced exploit code is needed—the attacker simply crafts a malicious OpenWire message and sends it via the broker's network interface. The vulnerability has a low attack complexity and no user interaction requirement once authenticated. The CVSS 3.1 score of 7.5 (HIGH) reflects the ease of exploitation for authenticated users combined with guaranteed availability impact.

Remediation

Upgrade immediately to Apache ActiveMQ 5.19.8 or 6.2.7, both of which include size validation on OpenWire message property maps. Before upgrading, restrict network and application access to brokers to trusted connections only. Monitor broker memory and process health for signs of OOM errors. Consider deploying brokers behind network segmentation to limit the reach of a compromised application account.

Patch guidance

Apply the following upgrades depending on your current version: if running 5.x, upgrade to 5.19.8 or later; if running 6.0.0 through 6.2.6, upgrade to 6.2.7 or later. Verify compatibility with your existing message clients before deploying—consult Apache's release notes for breaking changes. Test patches in a non-production environment that mirrors your topology, especially if you rely on custom protocol handlers or plugins. Plan for broker restarts during the maintenance window.

Detection guidance

Monitor ActiveMQ broker logs for repeated OOM exceptions or unexpected process crashes. Check JVM garbage collection logs for memory pressure spikes correlating with incoming messages. Network inspection can identify oversized OpenWire frame headers claiming disproportionately large payload sizes. Implement application-level logging on trusted clients to detect whether they are sending unexpected large message sizes. Alert on any ActiveMQ process restarts and correlate with authentication logs to identify which user or service account triggered the issue.

Why prioritize this

This vulnerability should be prioritized due to the guaranteed denial-of-service impact, the central role of message brokers in enterprise infrastructure, and the ease of exploitation by authenticated users. Although the CVSS score is 7.5 rather than critical, the business disruption potential is high because ActiveMQ failures cascade to dependent applications. The fix is available and straightforward to deploy. Organizations should treat this as a high-priority patch cycle item.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is appropriate: the vulnerability has network-based attack vector (AV:N) and low attack complexity (AC:L), but requires prior authentication (PR:N is misleading—the actual requirement is authentication, reflected in the practical exploitability). The impact is purely availability (A:H) with no confidentiality or integrity loss. The score correctly prioritizes this as serious but below critical severity due to authentication requirements and limited scope.

Frequently asked questions