{"id":"CVE-2026-53917","kind":"vulnerability","aliases":["CVE-2026-53917","GHSA-f77w-px59-cqf5"],"related":[],"title":"Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability","description":"Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.\n\nAn authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker.\nThis issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.","summary":"An authenticated user can send a crafted OpenWire message with an oversized encoded map size, and the broker unmarshals it without size checks. This exhausts memory and crashes the broker, causing denial of service.","severity":"high","cvss":7.5,"epss":0.0074,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.activemq:apache-activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-all","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-all","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-client","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-client","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-broker","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-broker","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"apache activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"vendor"},{"name":"apache activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"vendor"},{"name":"apache activemq broker","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"vendor"},{"name":"apache activemq broker","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["activemq","cwe-789","java","maven","message-broker","package"],"not_affected_if":["auth-required","fixed-version"],"how_to_check":"- Check the ActiveMQ version in the broker or the Maven dependency `org.apache.activemq` for versions below `5.19.8` or from `6.0.0` below `6.2.7`\n- Check whether OpenWire is exposed to untrusted or authenticated users on the network","fix":"- Apache ActiveMQ 5.x: upgrade to `5.19.8`\n- Apache ActiveMQ 6.x: upgrade to `6.2.7`\n- Apache ActiveMQ All, Client and Broker: same fixed versions, `5.19.8` and `6.2.7`","status":"open","published_at":"2026-06-30T11:16:30+00:00","first_seen_at":"2026-11-04T16:13:57+00:00","triaged_at":"2026-11-04T16:15:57+00:00","updated_at":"2026-11-04T16:28:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T16:15:57Z","model":"claude-haiku-5-5","output":{"fix":"- Apache ActiveMQ 5.x: upgrade to `5.19.8`\n- Apache ActiveMQ 6.x: upgrade to `6.2.7`\n- Apache ActiveMQ All, Client and Broker: same fixed versions, `5.19.8` and `6.2.7`","reach":"network","title":"Apache ActiveMQ: crafted OpenWire message can crash the broker with memory exhaustion","impact":"low","summary":"An authenticated user can send a crafted OpenWire message with an oversized encoded map size, and the broker unmarshals it without size checks. This exhausts memory and crashes the broker, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["activemq","java","maven","message-broker"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Broker crashes from memory exhaustion, causing denial of service","analyst_note":"","how_to_check":"- Check the ActiveMQ version in the broker or the Maven dependency `org.apache.activemq` for versions below `5.19.8` or from `6.0.0` below `6.2.7`\n- Check whether OpenWire is exposed to untrusted or authenticated users on the network","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","auth-required"],"who_is_affected":"Teams running Apache ActiveMQ (or the activemq-broker, activemq-client or activemq-all Maven artifacts) on versions before 5.19.8 or from 6.0.0 before 6.2.7. The attacker must hold valid broker credentials, so brokers with no authenticated users or with locked-down access carry less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000798,"input_tokens":4831,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':21A,29A '-53917':22A,30A '-789':75B '5.19.8':181C,190C,199C,208C,222C '6.0.0':183C,192C,201C,210C '6.2.7':185C,194C,203C,212C,220C 'activemq':2A,4A,7A,10A,34A,38A,41A,45A,49A,53A,57A,61A,64A,66A,68A,71A,73B,125C,127C,130C,133C,179C,187C,196C,205C 'activemq-all':40A,44A 'activemq-broker':56A,60A 'activemq-client':48A,52A 'affect':177C 'all':42A,46A 'alloc':14A,117C 'apach':1A,3A,6A,9A,124C,126C,129C,132C,178C,186C,195C,204C 'apache':33A,37A,63A,65A,67A,70A 'apache-activemq':32A,36A 'authent':83B,136C 'broker':11A,58A,62A,69A,72A,80B,99B,111B,134C,141C,174C,206C 'caus':112B,139C 'check':104B 'client':8A,50A,54A,131C,197C 'cqf5':27A 'craft':88B,146C 'crash':109B,172C 'cve':20A,28A 'cwe':74B 'denial':113B 'dos':142C 'encod':94B,152C 'excess':16A,119C 'exhaust':106B 'f77w':25A 'fix':224C 'ghsa':24A 'ghsa-f77w-px59-cqf5':23A 'issu':176C,226C 'java':76B 'larg':151C 'map':95B,157C,161C 'maven':77B 'memori':13A,107B,116C 'messag':79B,90B,148C,159C 'message-brok':78B 'oom':170C 'openwir':89B,147C,158C 'org.apache.activemq':31A,35A,39A,43A,47A,51A,55A,59A 'overs':93B 'packag':81B 'properti':160C 'px59':26A 'recommend':215C 'send':86B,144C 'servic':115B 'size':17A,96B,103B,120C,153C,165C 'trigger':169C 'unmarsh':100B,163C 'upgrad':217C 'user':84B,137C,213C 'valid':166C 'valu':18A,121C,154C 'version':219C 'vulner':19A,122C 'without':102B,164C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache ActiveMQ (or the activemq-broker, activemq-client or activemq-all Maven artifacts) on versions before 5.19.8 or from 6.0.0 before 6.2.7. The attacker must hold valid broker credentials, so brokers with no authenticated users or with locked-down access carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["activemq","activemqbroker","apacheactivemq","apacheactivemqbroker","orgapacheactivemqactivemqall","orgapacheactivemqactivemqbroker","orgapacheactivemqactivemqclient","orgapacheactivemqapacheactivemq"],"ptokens":["activemq","all","apache","broker","client","org"],"labels":["activemq","cwe789","high","java","maven","messagebroker","package","vendor"],"campaign_type":null,"first_public_at":"2026-06-30T11:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f77w-px59-cqf5","url":"https://github.com/advisories/GHSA-f77w-px59-cqf5","severity":"high","published_at":"2026-06-30T12:31:52+00:00","modified_at":"2026-11-04T16:10:29+00:00","first_seen_at":"2026-11-04T16:13:57+00:00","fetched_at":"2026-11-04T16:19:11+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-53917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53917","severity":null,"published_at":"2026-06-30T11:16:30+00:00","modified_at":"2026-07-02T18:41:55+00:00","first_seen_at":"2026-11-04T16:28:16+00:00","fetched_at":"2026-11-04T16:28:16+00:00","note":null}],"documents":[{"id":68017,"url":"https://github.com/apache/activemq/releases/tag/activemq-6.2.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68274,"url":"https://github.com/apache/activemq/commit/ecfd1336fa3f3f6116a78f0ab71d1b2f90bc717f","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68016,"url":"https://github.com/apache/activemq/releases/tag/activemq-5.19.8","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68271,"url":"https://github.com/apache/activemq/pull/2136","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68272,"url":"https://github.com/apache/activemq/commit/78bb8dcdc32e80c8b8813b57f89147572d16a2b9","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68273,"url":"https://github.com/apache/activemq/commit/b20e61c7ef736a04ad07a934ea8de628550c6cf2","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68524,"url":"http://www.openwall.com/lists/oss-security/2026/06/29/14","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"},{"id":68523,"url":"https://lists.apache.org/thread/grrd1mwgkgblqjbwkkq6dvmdxd9ov2dx","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}