CVE-2026-103582: Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)
Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0.
The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did not check that decoded lengths fit within the frame being read. A malicious or compromised broker, or an attacker able to intercept and modify an unencrypted connection, could send a crafted OpenWire frame with an oversized or negative length. This could cause the client to attempt very large memory allocations, leading to excessive memory consumption, an OutOfMemoryException or an uncaught exception, and a denial of service of the client application.
Users are recommended to upgrade to version 2.3.0, which enforces a configurable maximum frame size and validates lengths against the size of the frame being read.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache.NMS.ActiveMQto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Client applications using the Apache.NMS.ActiveMQ .NET OpenWire package before version 2.3.0 are affected. Exploitation requires the client to process OpenWire frames from a malicious or compromised broker, or from an attacker who can intercept and modify an unencrypted connection.
Does an attacker need access to the client host to trigger the denial of service?
No. The issue is triggered by a crafted network frame sent to the client. A malicious broker can send such a frame directly, while a network attacker would need the ability to modify an unencrypted client-broker connection.
What should be done if this client library is in use?
Upgrade Apache.NMS.ActiveMQ to version 2.3.0. That version adds configurable maximum frame-size enforcement and validates decoded lengths against the frame size.
How can I determine whether an application is affected?
Check whether the application uses the Apache.NMS.ActiveMQ package and identify its installed version. Versions before 2.3.0 should be treated as affected, particularly when they connect over unencrypted links or to brokers that may not be trusted.