Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-30T09:49:55 activemq-stomp: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-789

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. The vulnerability is in the Classic ActiveMQ STOMP NIO codec, which does not limit the size of header byte buffering, allowing an unauthenticated attacker to exhaust JVM heap memory. Apache ActiveMQ Artemis, which powers Red Hat AMQ Broker, has its own STOMP protocol implementation (artemis-stomp-protocol) that does not share this code path. The Classic STOMP NIO codec is not exposed in Red Hat product deployments. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat AMQ Broker 7 Fix deferred activemq-artemis-native Red Hat AMQ Broker 7 Fix deferred activemq-client Red Hat AMQ Broker 7 Fix deferred activemq-openwire-legacy Red Hat AMQ Broker 7 Fix deferred apache-artemis Red Hat AMQ Broker 7 Fix deferred artemis-amqp-protocol Red Hat AMQ Broker 7 Fix deferred artemis-boot Red Hat AMQ Broker 7 Fix deferred artemis-cli Red Hat AMQ Broker 7 Fix deferred artemis-commons Red Hat AMQ Broker 7 Fix deferred artemis-console Red Hat AMQ Broker 7 Fix deferred artemis-console-war Red Hat AMQ Broker 7 Fix deferred artemis-core-client Red Hat AMQ Broker 7 Fix deferred artemis-dto Red Hat AMQ Broker 7 Fix deferred artemis-hornetq-protocol Red Hat AMQ Broker 7 Fix deferred artemis-hqclient-protocol Red Hat AMQ Broker 7 Fix deferred artemis-jdbc-store Red Hat AMQ Broker 7 Fix deferred artemis-jms-client Red Hat AMQ Broker 7 Fix deferred artemis-jms-server Red Hat AMQ Broker 7 Fix deferred artemis-journal Red Hat AMQ Broker 7 Fix deferred artemis-lockmanager-api Red Hat AMQ Broker 7 Fix deferred artemis-lockmanager-ri Red Hat AMQ Broker 7 Fix deferred artemis-mqtt-protocol Red Hat AMQ Broker 7 Fix deferred artemis-openwire-protocol Red Hat AMQ Broker 7 Fix deferred artemis-ra Red Hat AMQ Broker 7 Fix deferred artemis-selector Red Hat AMQ Broker 7 Fix deferred artemis-server Red Hat AMQ Broker 7 Fix deferred artemis-service-extensions Red Hat AMQ Broker 7 Affected artemis-stomp-protocol Red Hat AMQ Broker 7 Fix deferred artemis-web Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-aarch64 Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-i686 Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-ppc64le Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-s390x Red Hat AMQ Broker 7 Fix deferred libartemis-native-linux-x86_64 Red Hat AMQ Clients Fix deferred activemq-artemis-native Red Hat AMQ Clients Fix deferred artemis-amqp-protocol Red Hat AMQ Clients Fix deferred artemis-commons Red Hat AMQ Clients Fix deferred artemis-core-client Red Hat AMQ Clients Fix deferred artemis-jdbc-store Red Hat AMQ Clients Fix deferred artemis-journal Red Hat AMQ Clients Fix deferred artemis-lockmanager-api Red Hat AMQ Clients Fix deferred artemis-selector Red Hat AMQ Clients Fix deferred artemis-server Red Hat build of Apache Camel for Spring Boot 4 Fix deferred activemq-artemis-native Red Hat build of Apache Camel for Spring Boot 4 Fix deferred artemis-mqtt-protocol Red Hat build of Apache Camel for Spring Boot 4 Fix deferred artemis-relocations-parent Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-aarch64 Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-i686 Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-ppc64le Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-s390x Red Hat build of Apache Camel for Spring Boot 4 Fix deferred libartemis-native-linux-x86_64 Red Hat Data Grid 8 Fix deferred zipkin-sender-activemq-client Red Hat Enterprise Linux 8 Fix deferred log4j:2/log4j Red Hat Fuse 7 Fix deferred activeio-core Red Hat Fuse 7 Fix deferred activemq-broker Red Hat Fuse 7 Fix deferred activemq-client Red Hat Fuse 7 Fix deferred activemq-console Red Hat Fuse 7 Fix deferred activemq-http Red Hat Fuse 7 Fix deferred activemq-jms-pool Red Hat Fuse 7 Fix deferred activemq-kahadb-store Red Hat Fuse 7 Fix deferred activemq-karaf Red Hat Fuse 7 Fix deferred activemq-log4j-appender Red Hat Fuse 7 Fix deferred activemq-mqtt Red Hat Fuse 7 Fix deferred activemq-openwire-legacy Red Hat Fuse 7 Fix deferred activemq-osgi Red Hat Fuse 7 Fix deferred activemq-pool Red Hat Fuse 7 Fix deferred activemq-protobuf Red Hat Fuse 7 Fix deferred activemq-spring Red Hat Fuse 7 Fix deferred activemq-stomp Red Hat JBoss Enterprise Application Platform 7 Fix deferred wildfly-messaging-activemq Red Hat JBoss Enterprise Application Platform 8 Fix deferred activemq-artemis-native Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-cli Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-commons Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-core-client Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-dto Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-hornetq-protocol Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-hqclient-protocol Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-client Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-ra Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-server Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jakarta-service-extensions Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-jdbc-store Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-journal Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-selector Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-server Red Hat JBoss Enterprise Application Platform 8 Fix deferred artemis-wildfly-integration Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-aarch64 Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-i686 Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-ppc64le Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-s390x Red Hat JBoss Enterprise Application Platform 8 Fix deferred libartemis-native-linux-x86_64 Red Hat JBoss Enterprise Application Platform 8 Fix deferred wildfly-messaging-activemq-injection Red Hat JBoss Enterprise Application Platform 8 Fix deferred wildfly-messaging-activemq-subsystem Red Hat Satellite 6 Fix deferred candlepin Red Hat Satellite 6 Fix deferred satellite:el8/candlepin Red Hat Single Sign-On 7 Fix deferred activemq-artemis-native Red Hat Single Sign-On 7 Fix deferred artemis-cli Red Hat Single Sign-On 7 Fix deferred artemis-commons Red Hat Single Sign-On 7 Fix deferred artemis-core-client Red Hat Single Sign-On 7 Fix deferred artemis-dto Red Hat Single Sign-On 7 Fix deferred artemis-hornetq-protocol Red Hat Single Sign-On 7 Fix deferred artemis-hqclient-protocol Red Hat Single Sign-On 7 Fix deferred artemis-jdbc-store Red Hat Single Sign-On 7 Fix deferred artemis-jms-client Red Hat Single Sign-On 7 Fix deferred artemis-jms-server Red Hat Single Sign-On 7 Fix deferred artemis-journal Red Hat Single Sign-On 7 Fix deferred artemis-ra Red Hat Single Sign-On 7 Fix deferred artemis-selector Red Hat Single Sign-On 7 Fix deferred artemis-server Red Hat Single Sign-On 7 Fix deferred artemis-service-extensions Red Hat Single Sign-On 7 Fix deferred artemis-tools Red Hat Single Sign-On 7 Fix deferred artemis-wildfly-integration Red Hat Single Sign-On 7 Fix deferred libartemis-native-linux-i686 Red Hat Single Sign-On 7 Fix deferred libartemis-native-linux-x86_64 Red Hat Single Sign-On 7 Fix deferred wildfly-messaging-activemq https://www.cve.org/CVERecord?id=CVE-2026-53916 https://nvd.nist.gov/vuln/detail/CVE-2026-53916 https://lists.apache.org/thread/07hjsj88hqgsb7vvg6ttsj56ts9vjs5n