CVE-2026-59878
Awaiting Analysis Awaiting Analysis - Queue

Denial-of-Service in Apache ActiveMQ via AMQP Frame Size

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Apache Software Foundation

Description
Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done rapidly enough can lead to exhaustion of the NIO thread pool denying service to other connections. This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8. Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-59878
EUVD
EUVD-2026-49848

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apache activemq_amqp to 6.2.8 (exc)
apache activemq to 6.2.8 (exc)
apache activemq_all to 6.2.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper input validation issue in Apache ActiveMQ AMQP, Apache ActiveMQ, and Apache ActiveMQ All. A remote unauthenticated attacker can send a specially crafted frame size value to an exposed AMQP NIO connector, causing NIO threads to crash. Repeated exploitation can exhaust the NIO thread pool, leading to a denial-of-service where other connections are denied service.

Detection Guidance

Monitor for excessive thread termination in Apache ActiveMQ AMQP NIO connectors. Check logs for repeated frame size errors or NIO thread pool exhaustion events. Use system monitoring tools to track thread pool usage and connection drops.

Impact Analysis

If exploited, this vulnerability can cause your Apache ActiveMQ services to become unavailable due to thread pool exhaustion. This may disrupt messaging operations, prevent legitimate users from connecting, and lead to service outages for applications relying on ActiveMQ.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires maintaining data processing integrity and availability, while HIPAA mandates ensuring access to protected health information. A successful DoS attack could violate these requirements by degrading or denying access to critical systems.

Mitigation Strategies

Upgrade Apache ActiveMQ AMQP, Apache ActiveMQ, and Apache ActiveMQ All to versions 5.19.9, 6.2.8, or 6.3.0 immediately. Disable the AMQP NIO connector if not required. Implement network-level restrictions to block untrusted sources from reaching the AMQP port.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59878. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart