CVE-2026-53916
Received Received - Intake

Memory Leak in Apache ActiveMQ STOMP

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: Apache Software Foundation

Description
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-30
Last Modified
2026-06-30
Generated
2026-06-30
AI Q&A
2026-06-30
EPSS Evaluated
N/A
NVD
CVE-2026-53916
EUVD
EUVD-2026-40278

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apache activemq From 6.0.0 (inc) to 6.2.7 (exc)
apache activemq_all From 6.0.0 (inc) to 6.2.7 (exc)
apache activemq_stomp From 6.0.0 (inc) to 6.2.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Memory Allocation with Excessive Size Value issue in Apache ActiveMQ and its related components. An unauthenticated client can open a STOMP NIO connection and send header bytes that never terminate. This causes the broker to buffer these bytes without any limit, which exhausts the Java Virtual Machine (JVM) heap memory.

Impact Analysis

The impact of this vulnerability is that it can cause the broker's JVM heap memory to be exhausted. This can lead to denial of service conditions where the broker becomes unresponsive or crashes, potentially disrupting messaging services that rely on Apache ActiveMQ.

Mitigation Strategies

Users are recommended to upgrade Apache ActiveMQ to version 6.2.7 or 5.19.8, which fixes the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53916. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart