Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-30T09:54:38 org.apache.activemq/activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-stomp: Apache ActiveMQ: Denial of Service via improper input validation in STOMP connector 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-839

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

A flaw was found in Apache ActiveMQ. A remote, unauthenticated attacker can exploit an improper input validation vulnerability by sending a specially crafted message with a negative content-length to an exposed STOMP connector. This can lead to a denial of service (DoS) condition, either by consuming excessive memory and causing an Out-Of-Memory (OOM) error or by forcing the abnormal closure of affected connections.

Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. The vulnerability is in the Classic ActiveMQ STOMP connector's content-length validation, allowing an unauthenticated attacker to cause OOM via a negative content-length value. Apache ActiveMQ Artemis, which powers Red Hat AMQ Broker, has its own STOMP protocol implementation (artemis-stomp-protocol) that does not share this code path. The Classic STOMP connector is not exposed in Red Hat product deployments. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat AMQ Broker 7 Fix deferred activemq-artemis-native Red Hat AMQ Broker 7 Fix deferred activemq-client Red Hat AMQ Broker 7 Fix deferred activemq-openwire-legacy Red Hat AMQ Broker 7 Fix deferred apache-artemis Red Hat AMQ Broker 7 Fix deferred artemis-amqp-protocol Red Hat AMQ Broker 7 Fix deferred artemis-boot Red Hat AMQ Broker 7 Fix deferred artemis-cli Red Hat AMQ Broker 7 Fix deferred artemis-commons Red Hat AMQ Broker 7 Fix deferred artemis-console Red Hat AMQ Broker 7 Fix deferred artemis-console-war Red Hat AMQ Broker 7 Fix deferred artemis-core-client Red Hat AMQ Broker 7 Fix deferred artemis-dto Red Hat AMQ Broker 7 Fix deferred artemis-hornetq-protocol Red Hat AMQ Broker 7 Fix deferred artemis-hqclient-protocol Red Hat AMQ Broker 7 Fix deferred artemis-jdbc-store Red Hat AMQ Broker 7 Fix deferred artemis-jms-client Red Hat AMQ Broker 7 Fix deferred artemis-jms-server Red Hat AMQ Broker 7 Fix deferred artemis-journal Red Hat AMQ Broker 7 Fix deferred artemis-lockmanager-api Red Hat AMQ Broker 7 Fix deferred artemis-lockmanager-ri Red Hat AMQ Broker 7 Fix deferred artemis-mqtt-protocol Red Hat AMQ Broker 7 Fix deferred artemis-openwire-protocol Red Hat AMQ Broker 7 Fix deferred artemis-ra Red Hat AMQ Broker 7 Fix deferred artemis-selector Red Hat AMQ Broker 7 Fix deferred artemis-server Red Hat AMQ Broker 7 Fix deferred artemis-service-extensions Red Hat AMQ Broker 7 Affected artemis-stomp-protocol Red Hat AMQ Broker 7 Fix deferred artemis-web Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-aarch64 Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-i686 Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-ppc64le Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-s390x Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-x86_64 Red Hat AMQ Clients Fix deferred activemq-artemis-native Red Hat AMQ Clients Fix deferred artemis-amqp-protocol Red Hat AMQ Clients Fix deferred artemis-commons Red Hat AMQ Clients Fix deferred artemis-core-client Red Hat AMQ Clients Fix deferred artemis-jdbc-store Red Hat AMQ Clients Fix deferred artemis-journal Red Hat AMQ Clients Fix deferred artemis-lockmanager-api Red Hat AMQ Clients Fix deferred artemis-selector Red Hat AMQ Clients Fix deferred artemis-server Red Hat build of Apache Camel for Spring Boot 4 Fix deferred activemq-artemis-native Red Hat build of Apache Camel for Spring Boot 4 Fix deferred artemis-mqtt-protocol Red Hat build of Apache Camel for Spring Boot 4 Fix deferred artemis-relocations-parent Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-aarch64 Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-i686 Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-ppc64le Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-s390x Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-x86_64 Red Hat Data Grid 8 Fix deferred zipkin-sender-activemq-client Red Hat Enterprise Linux 8 Fix deferred log4j:2/log4j Red Hat Fuse 7 Fix deferred activeio-core Red Hat Fuse 7 Fix deferred activemq-all Red Hat Fuse 7 Fix deferred activemq-broker Red Hat Fuse 7 Fix deferred activemq-client Red Hat Fuse 7 Fix deferred activemq-console Red Hat Fuse 7 Fix deferred activemq-http Red Hat Fuse 7 Fix deferred activemq-jms-pool Red Hat Fuse 7 Fix deferred activemq-kahadb-store Red Hat Fuse 7 Fix deferred activemq-karaf Red Hat Fuse 7 Fix deferred activemq-log4j-appender Red Hat Fuse 7 Fix deferred activemq-mqtt Red Hat Fuse 7 Fix deferred activemq-openwire-legacy Red Hat Fuse 7 Fix deferred activemq-osgi Red Hat Fuse 7 Fix deferred activemq-pool Red Hat Fuse 7 Fix deferred activemq-protobuf Red Hat Fuse 7 Fix deferred activemq-spring Red Hat Fuse 7 Fix deferred activemq-stomp Red Hat JBoss Enterprise Application Platform 7 Fix deferred wildfly-messaging-activemq Red Hat JBoss Enterprise Application Platform 8 Fix deferred activemq-artemis-native Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-cli Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-commons Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-core-client Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-dto Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-hornetq-protocol Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-hqclient-protocol Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-client Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-ra Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-server Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-service-extensions Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jdbc-store Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-journal Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-selector Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-server Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-wildfly-integration Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-aarch64 Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-i686 Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-ppc64le Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-s390x Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-x86_64 Red Hat JBoss Enterprise Application Platform 8 Fix deferred wildfly-messaging-activemq-injection Red Hat JBoss Enterprise Application Platform 8 Fix deferred wildfly-messaging-activemq-subsystem Red Hat Satellite 6 Fix deferred candlepin Red Hat Satellite 6 Fix deferred satellite:el8/candlepin Red Hat Single Sign-On 7 Fix deferred activemq-artemis-native Red Hat Single Sign-On 7 Fix deferred artemis-cli Red Hat Single Sign-On 7 Fix deferred artemis-commons Red Hat Single Sign-On 7 Fix deferred artemis-core-client Red Hat Single Sign-On 7 Fix deferred artemis-dto Red Hat Single Sign-On 7 Fix deferred artemis-hornetq-protocol Red Hat Single Sign-On 7 Fix deferred artemis-hqclient-protocol Red Hat Single Sign-On 7 Fix deferred artemis-jdbc-store Red Hat Single Sign-On 7 Fix deferred artemis-jms-client Red Hat Single Sign-On 7 Fix deferred artemis-jms-server Red Hat Single Sign-On 7 Fix deferred artemis-journal Red Hat Single Sign-On 7 Fix deferred artemis-ra Red Hat Single Sign-On 7 Fix deferred artemis-selector Red Hat Single Sign-On 7 Fix deferred artemis-server Red Hat Single Sign-On 7 Fix deferred artemis-service-extensions Red Hat Single Sign-On 7 Fix deferred artemis-tools Red Hat Single Sign-On 7 Fix deferred artemis-wildfly-integration Red Hat Single Sign-On 7 Fix deferred libartemis-native-linux-i686 Red Hat Single Sign-On 7 Fix deferred libartemis-native-linux-x86_64 Red Hat Single Sign-On 7 Fix deferred wildfly-messaging-activemq https://www.cve.org/CVERecord?id=CVE-2026-49432 https://nvd.nist.gov/vuln/detail/CVE-2026-49432 https://lists.apache.org/thread/fsjb26605syqr8xks249h8gkp86t55d2