CVE-2026-53917

Overview

Apache ActiveMQ Classic is an open-source Java message broker that provides asynchronous messaging for applications. It supports JMS 1.1 and multiple wire protocols, including OpenWire, AMQP, MQTT and STOMP. Broker and client components are published as Maven artifacts under org.apache.activemq. ActiveMQ Classic is distinct from Apache ActiveMQ Artemis, which has its own broker implementation and release lines.

A denial of service vulnerability (CVE-2026-53917) has been identified in the OpenWire message property unmarshaling code of Apache ActiveMQ Classic, which allows attackers to exhaust broker memory and crash the broker by sending a message whose property map declares a very large entry count.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Apache ActiveMQ Classic.

‍

Details

Module Info

• Product: Apache ActiveMQ Classic
• Affected packages: org.apache.activemq:apache-activemq, org.apache.activemq:activemq-all, org.apache.activemq:activemq-client, org.apache.activemq:activemq-broker
• Affected versions: <5.19.8, >=6.0.0 <6.2.7
• GitHub repository: https://github.com/apache/activemq
• Published packages:
  • https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq
  • https://central.sonatype.com/artifact/org.apache.activemq/activemq-all
  • https://central.sonatype.com/artifact/org.apache.activemq/activemq-client
  • https://central.sonatype.com/artifact/org.apache.activemq/activemq-broker
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Classic 5.19.8, 6.2.7
  • NES for ActiveMQ v5.16.12

Vulnerability Info

This High-severity vulnerability is found in the org.apache.activemq:activemq-client package in multiple versions of Apache ActiveMQ Classic, and is reachable through the broker shipped in org.apache.activemq:activemq-broker and the activemq-all and apache-activemq distributions.

OpenWire messages carry their properties as a marshaled primitive map. When the broker or a client needs the properties, for example to evaluate a selector or to dispatch the message, Message.lazyCreateProperties() decodes them through MarshallingSupport.unmarshalPrimitiveMap(). The single-argument overload used for message properties passes Integer.MAX_VALUE as the maximum property size:

private Map<String, Object> unmarsallProperties(ByteSequence marshalledProperties) throws IOException {
    return MarshallingSupport.unmarshalPrimitiveMap(new DataInputStream(new ByteArrayInputStream(marshalledProperties)));
}

public static Map<String, Object> unmarshalPrimitiveMap(DataInputStream in) throws IOException {
    return unmarshalPrimitiveMap(in, Integer.MAX_VALUE);
}

The decoder then reads a 4-byte entry count from the stream and uses it directly as the initial capacity of a HashMap:

public static Map<String, Object> unmarshalPrimitiveMap(DataInputStream in, int maxPropertySize, boolean force) throws IOException {
    int size = in.readInt();
    if (size > maxPropertySize) {
        throw new IOException("Primitive map is larger than the allowed size: " + size);
    }
    if (size < 0) {
        return null;
    } else {
        Map<String, Object> rc = new HashMap<String, Object>(size);
        for (int i = 0; i < size; i++) {
            String name = in.readUTF();
            rc.put(name, unmarshalPrimitive(in, force));
        }
        return rc;
    }
}

The count is never compared with the number of bytes actually left in the stream, and the maxPropertySize check cannot reject it because the limit is Integer.MAX_VALUE. A client that can send messages to the broker can therefore submit a small OpenWire message whose property map declares an entry count close to Integer.MAX_VALUE. The broker tries to allocate a hash table sized for that count before reading a single entry, which can raise an OutOfMemoryError and crash the broker, denying service to every connected client. List values decoded by unmarshalPrimitiveList() size their ArrayList from the encoded count in the same way.

‍

Mitigation

Inactive versions of Apache ActiveMQ Classic are End-of-Life and will not receive updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Apache ActiveMQ Classic that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• tonghuaroot (finder)