ORG.APACHE.ACTIVEMQ:APACHE-ACTIVEMQ · CVE-2026-53917 · Package
FIX → 5.19.8 · 6.2.7
An authenticated user can send a crafted OpenWire message with an oversized encoded map size, and the broker unmarshals it without size checks. This exhausts memory and crashes the broker, causing denial of service.
first public Jun 30, 2026 · 2 sources
Running Org.apache.activemq:apache-activemq? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams running Apache ActiveMQ (or the activemq-broker, activemq-client or activemq-all Maven artifacts) on versions before 5.19.8 or from 6.0.0 before 6.2.7. The attacker must hold valid broker credentials, so brokers with no authenticated users or with locked-down access carry less risk.
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.
An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7.
Not affected if auth-required, fixed-version
Who cares activemq, cwe-789, java, maven, message-broker
org.apache.activemq for versions below 5.19.8 or from 6.0.0 below 6.2.7Upgrade to 5.19.8 · 6.2.7
5.19.86.2.75.19.8 and 6.2.7Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-53917") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.