CVE-2026-103582 · Package
NO FIX YET · SEE WHAT TO DO
The .NET OpenWire client (Apache.NMS.ActiveMQ) before 2.3.0 trusts frame size and length fields from the network without bounds checks. A malicious broker or an attacker who can modify an unencrypted connection can send a crafted frame that forces huge allocations, causing a denial of service of the client application.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications built on the .NET Apache NMS ActiveMQ client that connect to an ActiveMQ broker, especially over unencrypted connections where traffic could be intercepted or where the broker is not fully trusted. Applications not using this package, or not connecting to ActiveMQ over OpenWire, can skip it.
Not affected if no-openwire-connection, not-using-apache-nms
Who cares activemq, dotnet, nuget, openwire
Apache.NMS.ActiveMQ package in the project's NuGet references (dotnet list package).Apache.NMS.ActiveMQ version below 2.3.0.2.3.0 or later, which enforces a configurable maximum frame size and validates lengths against the frame being read.Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0.
The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did not check that decoded lengths fit within the frame being read. A malicious or compromised broker, or an attacker able to intercept and modify an unencrypted connection, could send a crafted OpenWire frame with an oversized or negative length. This could cause the client to attempt very large memory allocations, leading to excessive memory consumption, an OutOfMemoryException or an uncaught exception, and a denial of service of the client application.
Users are recommended to upgrade to version 2.3.0, which enforces a configurable maximum frame size and validates lengths against the size of the frame being read.
This page as .md · .json · in your agent: get_signal("CVE-2026-103582")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.