{"id":"CVE-2026-103582","kind":"vulnerability","aliases":["CVE-2026-103582"],"related":[],"title":"Apache NMS ActiveMQ .NET client: crafted frame crashes client with memory exhaustion","description":"Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0.\n\n\n\nThe OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did not check that decoded lengths fit within the frame being read. A malicious or compromised broker, or an attacker able to intercept and modify an unencrypted connection, could send a crafted OpenWire frame with an oversized or negative length. This could cause the client to attempt very large memory allocations, leading to excessive memory consumption, an OutOfMemoryException or an uncaught exception, and a denial of service of the client application.\n\n\n\nUsers are recommended to upgrade to version 2.3.0, which enforces a configurable maximum frame size and validates lengths against the size of the frame being read.","summary":"The .NET OpenWire client (Apache.NMS.ActiveMQ) before 2.3.0 trusts frame size and length fields from the network without bounds checks. A malicious broker or an attacker who can modify an unencrypted connection can send a crafted frame that forces huge allocations, causing a denial of service of the client application.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["activemq","dotnet","nuget","openwire","package"],"not_affected_if":["no-openwire-connection","not-using-apache-nms"],"how_to_check":"- Check the installed version of the `Apache.NMS.ActiveMQ` package in the project's NuGet references (`dotnet list package`).\n- Look for any `Apache.NMS.ActiveMQ` version below `2.3.0`.","fix":"- Apache.NMS.ActiveMQ: upgrade to `2.3.0` or later, which enforces a configurable maximum frame size and validates lengths against the frame being read.","status":"open","published_at":"2026-11-04T11:17:13+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","triaged_at":"2026-11-04T11:27:49+00:00","updated_at":"2026-11-04T11:27:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T11:27:49Z","model":"claude-haiku-5-5","output":{"fix":"- Apache.NMS.ActiveMQ: upgrade to `2.3.0` or later, which enforces a configurable maximum frame size and validates lengths against the frame being read.","reach":"network","title":"Apache NMS ActiveMQ .NET client: crafted frame crashes client with memory exhaustion","impact":"medium","summary":"The .NET OpenWire client (Apache.NMS.ActiveMQ) before 2.3.0 trusts frame size and length fields from the network without bounds checks. A malicious broker or an attacker who can modify an unencrypted connection can send a crafted frame that forces huge allocations, causing a denial of service of the client application.","audience":"developers","category":"package","nicknames":[],"who_cares":["dotnet","activemq","openwire","nuget"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"client application crashes or stops from memory exhaustion","analyst_note":"","how_to_check":"- Check the installed version of the `Apache.NMS.ActiveMQ` package in the project's NuGet references (`dotnet list package`).\n- Look for any `Apache.NMS.ActiveMQ` version below `2.3.0`.","plain_action":"","needs_analyst":false,"not_affected_if":["not-using-apache-nms","no-openwire-connection"],"who_is_affected":"Applications built on the .NET Apache NMS ActiveMQ client that connect to an ActiveMQ broker, especially over unencrypted connections where traffic could be intercepted or where the broker is not fully trusted. Applications not using this package, or not connecting to ActiveMQ over OpenWire, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4329,"output_tokens":613,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103582':15A,18A '-2026':14A,17A '2.3.0':30B,92C,199C 'abl':141C 'activemq':3A,19B,84C 'alloc':63B,75C,171C 'apach':1A,82C 'apache.nms.activemq':28B,90C 'applic':72B,191C 'attack':48B,140C 'attempt':167C 'bound':41B 'broker':45B,137C 'caus':64B,163C 'check':42B,123C 'client':5A,9A,27B,71B,88C,165C,190C 'code':96C 'compromis':136C 'configur':203C 'connect':54B,148C 'consumpt':176C 'could':149C,162C 'count':105C 'craft':6A,58B,152C 'crash':8A 'cve':13A,16A 'decod':125C 'denial':66B,185C 'dotnet':20B 'enforc':114C,201C 'except':182C 'excess':174C 'exhaust':12A 'field':36B,106C 'fit':127C 'forc':61B 'frame':7A,32B,59B,78C,99C,117C,130C,154C,205C,215C 'huge':62B 'intercept':143C 'larg':169C 'lead':172C 'length':35B,103C,126C,160C,209C 'malici':44B,134C 'maximum':116C,204C 'memori':11A,74C,170C,175C 'miss':77C 'modifi':51B,145C 'negat':159C 'net':4A,25B,86C 'network':39B,110C 'nms':2A,83C 'nuget':21B 'openwir':22B,26B,87C,94C,153C 'outofmemoryexcept':178C 'overs':157C 'packag':23B,89C 'read':107C,132C,217C 'recommend':194C 'send':56B,150C 'servic':68B,187C 'size':33B,79C,100C,118C,206C,212C 'trust':31B,97C 'unbound':73C 'uncaught':181C 'unencrypt':53B,147C 'unmarshal':95C 'upgrad':196C 'user':192C 'valid':80C,208C 'version':198C 'within':128C 'without':40B","nicknames":[],"mitigations":[],"who_affected":"Applications built on the .NET Apache NMS ActiveMQ client that connect to an ActiveMQ broker, especially over unencrypted connections where traffic could be intercepted or where the broker is not fully trusted. Applications not using this package, or not connecting to ActiveMQ over OpenWire, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activemq","dotnet","high","nuget","openwire","package"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103582","severity":null,"published_at":"2026-11-04T11:17:13+00:00","modified_at":"2026-11-04T11:17:13+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","fetched_at":"2026-11-04T11:26:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}