PT-2026-53844 · Apache · Apache Activemq+2

Tonghuaroot · Publicado 2026-06-30 · Atualizado 2026-06-30 · CVE-2026-53916

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.

An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Correção

Enumeração de Fraquezas

CWE-789

Identificadores relacionados

CVE-2026-53916

Produtos afetados

Apache Activemq

Apache Activemq Apollo

Apache Activemq Stomp

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-53916 · Nota de Segurança
• http://openwall.com/lists/oss-security/2026/06/29/13 · Nota
• https://lists.apache.org/thread/07hjsj88hqgsb7vvg6ttsj56ts9vjs5n · Aviso do Fabricante