BIT-activemq-2026-59878: Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS

Q: Which deployments are exposed to this issue?

Deployments are exposed when an AMQP NIO connector is reachable by a remote peer. The attacker does not need authentication, so any exposed connector reachable by untrusted networks is at risk.

Q: What does an attacker need to do to cause the denial of service?

An attacker needs network access to the exposed AMQP NIO connector and can send a frame size value that bypasses negative frame-size validation. Repeated requests can kill NIO threads quickly enough to exhaust the NIO thread pool and deny service to other connections.

Q: Which versions should be upgraded?

Upgrade to ActiveMQ version 5.19.9, 6.2.8, or 6.3.0. Affected releases are versions before 5.19.9 and versions from 6.0.0 before 6.2.8.

Published Jul 28, 2026

Updated

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All.

A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done rapidly enough can lead to exhaustion of the NIO thread pool denying service to other connections. This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8.

Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which fixes the issue.

Affected Software

3 affected components

Apache ActiveMQ AMQP<5.19.9, >=6.0.0<6.2.8

Apache ActiveMQ<5.19.9, >=6.0.0<6.2.8

Apache ActiveMQ All<5.19.9, >=6.0.0<6.2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache ActiveMQ AMQP to a version that resolves this vulnerability.
Fixed in 5.19.9
Upgrade
Upgrade Apache ActiveMQ AMQP to a version that resolves this vulnerability.
Fixed in 6.2.8
Upgrade
Upgrade Apache ActiveMQ AMQP to a version that resolves this vulnerability.
Fixed in 6.3.0

Event History

Jul 28, 2026

CVE Published

via OSV·01:33 PM

Data Sourced

via OSV·01:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments are exposed when an AMQP NIO connector is reachable by a remote peer. The attacker does not need authentication, so any exposed connector reachable by untrusted networks is at risk.

What does an attacker need to do to cause the denial of service?

An attacker needs network access to the exposed AMQP NIO connector and can send a frame size value that bypasses negative frame-size validation. Repeated requests can kill NIO threads quickly enough to exhaust the NIO thread pool and deny service to other connections.

Which versions should be upgraded?

Upgrade to ActiveMQ version 5.19.9, 6.2.8, or 6.3.0. Affected releases are versions before 5.19.9 and versions from 6.0.0 before 6.2.8.

BIT-activemq-2026-59878: Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to cause the denial of service?

Which versions should be upgraded?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to cause the denial of service?

Which versions should be upgraded?