CVE-2026-49432: Apache ActiveMQ STOMP DoS Vulnerability

CVE-2026-49432 Overview

CVE-2026-49432 is an improper input validation vulnerability [CWE-20] in Apache ActiveMQ affecting the STOMP connector. A remote unauthenticated attacker who can reach an exposed STOMP endpoint can trigger denial-of-service conditions by sending a frame with a negative content-length header. The flaw impacts Apache ActiveMQ, Apache ActiveMQ All, and Apache ActiveMQ Stomp releases before 5.19.8 and versions 6.0.0 through 6.2.6. Apache has released fixed builds 5.19.8 and 6.2.7.

Critical Impact
Unauthenticated attackers can exhaust broker memory through the NIO STOMP transport, causing out-of-memory conditions and full broker outage on production message queues.

Affected Products

Apache ActiveMQ before 5.19.8 and from 6.0.0 before 6.2.7
Apache ActiveMQ All before 5.19.8 and from 6.0.0 before 6.2.7
Apache ActiveMQ Stomp before 5.19.8 and from 6.0.0 before 6.2.7

Discovery Timeline

2026-06-30 - CVE-2026-49432 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-49432

Vulnerability Analysis

The Simple Text Oriented Messaging Protocol (STOMP) connector in Apache ActiveMQ fails to validate the content-length header on incoming frames. When the value is negative, the broker's framing logic misinterprets the declared body size and no longer enforces the configured per-connection command buffer limits. On the non-blocking I/O (NIO) STOMP transport, the connection handler continues to accept streamed body bytes indefinitely, growing an in-memory buffer that eventually consumes all available Java Virtual Machine (JVM) heap. On the blocking STOMP transport, the malformed length triggers a transport exception that forces abnormal closure of the affected connection instead of memory growth. The vulnerability requires no authentication and can be triggered against any broker that exposes a STOMP or STOMP+NIO connector to attacker-reachable networks.

Root Cause

The root cause is missing validation of the content-length frame header before it is used as a size hint for buffer allocation and read-loop termination. A negative integer bypasses the buffer-limit comparison, allowing the parser to keep reading body data. Apache classifies the issue under [CWE-20: Improper Input Validation].

Attack Vector

Exploitation requires network reachability to an exposed STOMP connector. The attacker sends a well-formed STOMP frame such as SEND or CONNECT with content-length:-1 and then continues streaming body bytes over the TCP session. Against the NIO transport, the broker accumulates the payload until the JVM throws OutOfMemoryError, taking the broker offline. Against the blocking transport, the same input forces transport exception handling and terminates the connection, which an attacker can loop to disrupt legitimate producers and consumers.

No public proof-of-concept has been published. Detailed protocol behavior is described in the Apache Mailing List Thread and the OpenWall OSS Security Update.

Detection Methods for CVE-2026-49432

Indicators of Compromise

STOMP frames containing a negative content-length header value received on ports 61613, 61614, or any custom STOMP connector port.
Broker log entries showing TransportException or abnormal STOMP frame closures correlated to a single remote peer.
JVM heap growth on the ActiveMQ process followed by java.lang.OutOfMemoryError: Java heap space without a corresponding increase in legitimate message throughput.

Detection Strategies

Inspect STOMP connector traffic for header lines matching content-length:\s*-\d+ and alert on any match from unauthenticated peers.
Correlate broker restarts or crash dumps with preceding spikes in bytes-in on STOMP listeners from a single source IP.
Monitor for repeated short-lived STOMP connections that terminate with parser or transport exceptions.

Monitoring Recommendations

Track ActiveMQ JMX metrics for HeapMemoryUsage, ConnectionCount, and per-connector EnqueueCount to identify anomalous consumption.
Ship activemq.log and wrapper.log to a centralized log platform and alert on repeated TransportException events tied to STOMP.
Enable network flow logging on broker subnets to identify unexpected external clients reaching STOMP ports.

How to Mitigate CVE-2026-49432

Immediate Actions Required

Upgrade Apache ActiveMQ to 5.19.8 or 6.2.7 on all broker nodes, including any embedded deployments.
Restrict network access to STOMP connectors so that only authenticated application tiers can reach ports 61613 and 61614.
Audit broker configuration for exposed STOMP or STOMP+NIO transports that are not required and disable them.

Patch Information

Apache has released fixed versions 5.19.8 and 6.2.7. Users are directed to upgrade per the Apache Mailing List Thread. The fix adds validation that rejects frames whose content-length header is not a non-negative integer within configured limits.

Workarounds

Remove or comment out unused STOMP transportConnector entries in activemq.xml until patching is complete.
Place the broker behind a reverse proxy or firewall that enforces STOMP frame inspection and drops frames with negative content-length.
Enforce STOMP authentication and require TLS on STOMP connectors to reduce the population of clients able to send arbitrary frames.

bash

# Example activemq.xml hardening: bind STOMP to loopback only until patched
<transportConnectors>
    <transportConnector
        name="stomp"
        uri="stomp://127.0.0.1:61613?transport.closeAsync=false"/>
</transportConnectors>