REDHAT-BUG-2494846: High severity Apache ActiveMQ vulnerability

Q: Who can exploit this issue?

An unauthenticated client that can open a STOMP NIO connection to the broker can trigger the condition. No authentication is required.

Q: What does an attacker need to send?

The attacker sends STOMP header bytes that do not terminate. The broker buffers these bytes without limit, which can exhaust the JVM heap.

Q: Which versions require remediation?

Affected releases are versions before 5.19.8 and versions from 6.0.0 before 6.2.7 for Apache ActiveMQ, Apache ActiveMQ All, and Apache ActiveMQ Stomp. Upgrade to 5.19.8 or 6.2.7.

Published Jun 30, 2026

Updated

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.

An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Affected Software

3 affected components

Apache ActiveMQ<5.19.8, >=6.0.0<6.2.7

Apache ActiveMQ All<5.19.8, >=6.0.0<6.2.7

Apache ActiveMQ Stomp<5.19.8, >=6.0.0<6.2.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 6.2.7
Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 5.19.8

Event History

Jun 30, 2026

Data Sourced

via Red Hat·11:02 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated client that can open a STOMP NIO connection to the broker can trigger the condition. No authentication is required.

What does an attacker need to send?

The attacker sends STOMP header bytes that do not terminate. The broker buffers these bytes without limit, which can exhaust the JVM heap.

Which versions require remediation?

Affected releases are versions before 5.19.8 and versions from 6.0.0 before 6.2.7 for Apache ActiveMQ, Apache ActiveMQ All, and Apache ActiveMQ Stomp. Upgrade to 5.19.8 or 6.2.7.

REDHAT-BUG-2494846: High severity Apache ActiveMQ vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send?

Which versions require remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send?

Which versions require remediation?