ORG.APACHE.ACTIVEMQ:APACHE-ACTIVEMQ · CVE-2026-49432 · Package
FIX → 5.19.8 · 6.2.7
A negative content-length in a STOMP frame can make the ActiveMQ STOMP connector exhaust memory on the NIO transport or drop the connection on the blocking transport. An unauthenticated remote peer that can reach the STOMP connector can cause denial of service.
first public Jun 30, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run Apache ActiveMQ, the ActiveMQ All bundle or the ActiveMQ STOMP module with a STOMP connector reachable by untrusted peers. Brokers that only accept STOMP from trusted internal networks or do not enable the STOMP connector are less exposed. The sources do not say whether the default configuration enables STOMP.
Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Not affected if internal-network-only, stomp-connector-disabled
Who cares activemq, cwe-20, cwe-839, java, message-broker, stomp
org.apache.activemq:apache-activemq, activemq-all or activemq-stomp.Upgrade to 5.19.8 · 6.2.7
org.apache.activemq 5.x to 5.19.8.org.apache.activemq 6.x to 6.2.7.GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.