CVE-2026-53916: Apache ActiveMQ DOS Vulnerability

CVE-2026-53916 Overview

CVE-2026-53916 is a memory allocation vulnerability in Apache ActiveMQ affecting the STOMP NIO transport connector. An unauthenticated remote client can open a STOMP connection and send header bytes that never terminate. The broker buffers these bytes without a size limit, eventually exhausting the Java Virtual Machine (JVM) heap and causing a denial-of-service condition.

The flaw is tracked as [CWE-789: Memory Allocation with Excessive Size Value] and impacts Apache ActiveMQ versions before 5.19.8 and 6.0.0 through 6.2.6. Apache has released fixes in versions 5.19.8 and 6.2.7.

Critical Impact
A single unauthenticated attacker can exhaust the broker's JVM heap, taking the message broker offline and disrupting any application that depends on ActiveMQ for messaging.

Affected Products

Apache ActiveMQ before 5.19.8 and from 6.0.0 before 6.2.7
Apache ActiveMQ All before 5.19.8 and from 6.0.0 before 6.2.7
Apache ActiveMQ Stomp before 5.19.8 and from 6.0.0 before 6.2.7

Discovery Timeline

2026-06-30 - CVE-2026-53916 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-53916

Vulnerability Analysis

Apache ActiveMQ exposes the Streaming Text Oriented Messaging Protocol (STOMP) over a non-blocking I/O (NIO) transport. STOMP frames consist of a command line, a set of headers terminated by a blank line, and an optional body. The broker reads header bytes into an in-memory buffer while it waits for the terminating sequence that signals the end of the header block.

The vulnerable code path does not enforce a maximum size on the header buffer. An attacker who opens a TCP connection to the STOMP NIO port can send an endless stream of bytes that never includes the header terminator. The broker keeps appending these bytes to its buffer, consuming heap memory in proportion to the amount of data the attacker sends.

Because STOMP does not require authentication before the initial CONNECT frame is parsed, no credentials are needed to trigger the condition. A small number of concurrent connections is sufficient to drive the JVM into OutOfMemoryError and terminate broker operations.

Root Cause

The root cause is missing input length validation in the STOMP NIO frame parser. The parser treats header ingestion as an open-ended read loop rather than bounding it by a configurable maximum frame or header size. This aligns with [CWE-789], where an untrusted value drives an unbounded allocation.

Attack Vector

Exploitation requires only network reachability to the STOMP NIO listener, typically TCP port 61613. The attacker opens one or more sockets, writes a STOMP command such as CONNECT followed by header bytes, and omits the double CRLF terminator. Sustained writes cause the broker's heap usage to climb until the JVM cannot allocate further objects, halting message processing for all clients.

The vulnerability affects availability only. Confidentiality and integrity are not impacted. See the Apache Mailing List Thread and the Openwall OSS Security Discussion for the vendor's technical description.

Detection Methods for CVE-2026-53916

Indicators of Compromise

STOMP connections that remain open for extended periods without completing a CONNECT frame or sending a body.
Steady growth of JVM heap usage on the ActiveMQ broker without a corresponding increase in queue depth or consumer count.
java.lang.OutOfMemoryError: Java heap space entries in activemq.log originating from STOMP transport threads.
Broker restarts or unresponsive client sessions correlating with traffic on TCP 61613 or the configured STOMP NIO port.

Detection Strategies

Monitor per-connection byte counts on the STOMP listener and alert when a single client sends header data exceeding a reasonable threshold (for example, 64 KB) without frame completion.
Inspect network flows to identify long-lived STOMP sessions from unauthenticated sources that transmit continuously but do not receive broker responses.
Track JVM heap and garbage collection metrics through JMX and correlate spikes with active STOMP connection counts.

Monitoring Recommendations

Enable ActiveMQ transport-level logging at DEBUG for the STOMP connector during triage to capture partial frame reads.
Forward broker logs and JVM metrics to a centralized analytics platform for correlation across the messaging tier.
Alert on repeated broker restarts or OutOfMemoryError events, which can indicate active exploitation.

How to Mitigate CVE-2026-53916

Immediate Actions Required

Upgrade Apache ActiveMQ to version 5.19.8 or 6.2.7, which enforce a bounded header buffer on the STOMP NIO transport.
Restrict network access to the STOMP listener so that only trusted application hosts can reach TCP 61613 or the configured port.
Terminate any suspicious long-lived STOMP connections identified during monitoring.

Patch Information

Apache has released fixed versions 5.19.8 and 6.2.7. Refer to the Apache Mailing List Thread for release notes and download links. Operators running any 6.x release before 6.2.7 or any 5.x release before 5.19.8 must upgrade.

Workarounds

Disable the STOMP transport connector in activemq.xml if STOMP is not required by client applications.
Place the broker behind a network firewall or service mesh policy that limits inbound STOMP connections to authenticated peers.
Reduce broker exposure by binding the STOMP NIO listener to an internal interface only.

bash

# Example: remove or comment out the STOMP NIO connector in activemq.xml
# <transportConnector name="stomp+nio" uri="stomp+nio://0.0.0.0:61613"/>

# Restrict access at the host firewall (Linux example)
sudo iptables -A INPUT -p tcp --dport 61613 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 61613 -j DROP