Improper input validation in Apache Activemq
CVE-2026-49432
Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.006 (44.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Apache Activemq
- Apache Software Foundation Activemq — versions 0, 6.0.0
- Apache Software Foundation Activemq All — versions 0, 6.0.0
- Apache Software Foundation Activemq Stomp — versions 0, 6.0.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)
Frequently asked questions
- What is CVE-2026-49432?
- CVE-2026-49432 is a high-severity vulnerability in Apache Activemq, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2026-06-30.
- How severe is CVE-2026-49432?
- High severity. CVSS v3 base score is 7.5 out of 10.