CVE-2026-59878

Overview

Apache ActiveMQ Classic is an open-source Java message broker that provides asynchronous messaging for applications. It supports JMS 1.1 and multiple wire protocols, including OpenWire, AMQP, MQTT and STOMP. Broker and client components are published as Maven artifacts under org.apache.activemq. ActiveMQ Classic is distinct from Apache ActiveMQ Artemis, which has its own broker implementation and release lines.

A denial of service vulnerability (CVE-2026-59878) has been identified in the AMQP NIO transport of Apache ActiveMQ Classic, which allows a remote unauthenticated peer that can reach an exposed AMQP NIO connector to kill broker NIO threads by sending a negative frame size value. Repeated rapidly enough, this can exhaust the NIO thread pool and deny service to other connections.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Apache ActiveMQ Classic.

‍

Details

Module Info

• Product: Apache ActiveMQ Classic
• Affected packages: org.apache.activemq:activemq-amqp, org.apache.activemq:apache-activemq, org.apache.activemq:activemq-all
• Affected versions: <5.19.9, >=6.0.0 <6.2.8
• GitHub repository: https://github.com/apache/activemq
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/activemq-amqp, https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq, https://central.sonatype.com/artifact/org.apache.activemq/activemq-all
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Classic 5.19.9, 6.2.8, 6.3.0
  • NES for ActiveMQ v5.16.12

Vulnerability Info

This High-severity vulnerability is found in the org.apache.activemq:activemq-amqp package in multiple versions of Apache ActiveMQ Classic. When a client connects to an AMQP NIO connector, AmqpFrameParser reads the 4-byte AMQP frame size into a signed Java int and passes it to validateFrameSize before allocating a buffer for the frame body. The check only rejects values larger than the configured maximum frame size:

private void validateFrameSize(int frameSize) throws IOException {
    long maxFrameSize = AmqpWireFormat.DEFAULT_MAX_FRAME_SIZE;
    if (wireFormat != null) {
        maxFrameSize = wireFormat.getMaxFrameSize();
    }

    if (frameSize > maxFrameSize) {
        throw IOExceptionSupport.createFrameSizeException(frameSize, maxFrameSize);
    }
}

AMQP frame sizes are unsigned 32-bit values, so a frame size with the high bit set (for example 0xFFFFFF9C) is read as a negative number. A negative value is never greater than the maximum, so it passes validation and is handed to the content reader, which allocates the frame buffer directly from it:

frame = new Buffer(nextExpectedReadSize);
frame.bigEndianEditor().writeInt(nextExpectedReadSize);

The allocation fails with a runtime exception instead of the frame size error the parser expects, and no authentication is needed because the frame size is read before any AMQP or SASL negotiation completes. The Apache advisory states that this causes the broker's NIO threads to die, and that an attacker who repeats it rapidly enough can exhaust the NIO thread pool, denying service to every other connection served by it.

‍

Mitigation

Inactive versions of Apache ActiveMQ Classic are End-of-Life and will not receive updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Apache ActiveMQ Classic that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• zx (Jace) (finder)