CVE-2026-59878: Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS
Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All.
A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done rapidly enough can lead to exhaustion of the NIO thread pool denying service to other connections. This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8.
Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQ AMQPto a version that resolves this vulnerability.Fixed in 5.19.9Patch CVE-2026-59878 - Upgrade
Upgrade
Apache ActiveMQ AMQPto a version that resolves this vulnerability.Fixed in 6.2.8Patch CVE-2026-59878 - Upgrade
Upgrade
Apache ActiveMQ AMQPto a version that resolves this vulnerability.Fixed in 6.3.0Patch CVE-2026-59878 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.19.9Patch CVE-2026-59878 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.2.8Patch CVE-2026-59878 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.3.0Patch CVE-2026-59878 - Upgrade
Upgrade
Apache ActiveMQ Allto a version that resolves this vulnerability.Fixed in 5.19.9Patch CVE-2026-59878 - Upgrade
Upgrade
Apache ActiveMQ Allto a version that resolves this vulnerability.Fixed in 6.2.8Patch CVE-2026-59878 - Upgrade
Upgrade
Apache ActiveMQ Allto a version that resolves this vulnerability.Fixed in 6.3.0Patch CVE-2026-59878
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59878?
CVE-2026-59878 has a severity rating of 7.5, which is classified as high.
How do I fix CVE-2026-59878?
To mitigate CVE-2026-59878, ensure that your Apache ActiveMQ is updated to the patched version that addresses this vulnerability.
What causes CVE-2026-59878 vulnerability?
CVE-2026-59878 is caused by improper input validation that allows a remote unauthenticated peer to send a negative frame size value leading to denial-of-service.
What is the impact of CVE-2026-59878?
The impact of CVE-2026-59878 can result in denial-of-service behavior by crashing NIO threads in Apache ActiveMQ.
Who is affected by CVE-2026-59878?
CVE-2026-59878 affects all versions of Apache ActiveMQ that expose an AMQP NIO connector.