CVE-2026-53917 Overview
CVE-2026-53917 is a memory allocation vulnerability [CWE-789] in Apache ActiveMQ that allows an authenticated user to crash the broker through a crafted OpenWire message. The flaw exists in how OpenWire message property maps are unmarshaled without validating the encoded size value. An attacker can send a message with an oversized map size, causing the broker to allocate excessive memory and trigger an Out-of-Memory (OOM) condition.
The vulnerability affects Apache ActiveMQ, ActiveMQ All, ActiveMQ Client, and ActiveMQ Broker distributions across the 5.x and 6.x branches. Apache addressed the issue in versions 5.19.8 and 6.2.7.
Critical Impact
Any authenticated user with OpenWire access can crash the broker, disrupting all message-dependent applications and services relying on the ActiveMQ deployment.
Affected Products
- Apache ActiveMQ (before 5.19.8, and 6.0.0 before 6.2.7)
- Apache ActiveMQ Broker (before 5.19.8, and 6.0.0 before 6.2.7)
- Apache ActiveMQ Client and Apache ActiveMQ All (before 5.19.8, and 6.0.0 before 6.2.7)
Discovery Timeline
- 2026-06-30 - CVE-2026-53917 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-53917
Vulnerability Analysis
Apache ActiveMQ uses the OpenWire protocol as its native binary wire format for client-broker communication. OpenWire messages support property maps, which are key-value pairs serialized alongside the message payload. During unmarshaling, the broker reads an encoded size value that indicates how many entries the map contains.
The vulnerable code path allocates memory based on this attacker-controlled size value without validating it against sane bounds or available heap capacity. When a client submits a crafted message declaring an excessively large map size, the broker attempts to allocate a corresponding data structure and exhausts available JVM heap memory. The result is an OutOfMemoryError that crashes the broker process.
Root Cause
The root cause is missing input validation on a size field within the OpenWire deserialization routine for message property maps. The code trusts the declared size and proceeds directly to allocation. This pattern maps to CWE-789: Memory Allocation with Excessive Size Value.
Attack Vector
Exploitation requires an authenticated connection to the OpenWire transport. Once authenticated, the attacker constructs an OpenWire message whose property map header advertises a size value large enough to force memory exhaustion. Sending the message to the broker triggers the faulty unmarshal path and crashes the JVM. The attack is single-shot and does not require additional interaction. Public exploit code is not available at time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
For technical details, refer to the Apache Security Mailing List Thread and the Openwall OSS Security Update.
Detection Methods for CVE-2026-53917
Indicators of Compromise
- Broker JVM logs containing java.lang.OutOfMemoryError originating from OpenWire unmarshaling stack frames.
- Unexpected ActiveMQ broker restarts or process termination shortly after client authentication events.
- Anomalously large OpenWire frames arriving on ports 61616 (default) or other configured OpenWire transports.
Detection Strategies
- Enable ActiveMQ debug logging on the OpenWire transport and alert on repeated unmarshal exceptions from a single authenticated principal.
- Monitor broker heap usage through JMX and correlate sudden heap spikes with inbound client sessions.
- Deploy network inspection rules that flag OpenWire frames declaring map sizes beyond expected application thresholds.
Monitoring Recommendations
- Track authentication events for OpenWire connections and identify accounts producing broker crashes.
- Collect and centralize activemq.log and JVM crash dumps for post-incident review.
- Alert on ActiveMQ service availability changes through health-check probes against the broker's admin interface.
How to Mitigate CVE-2026-53917
Immediate Actions Required
- Upgrade Apache ActiveMQ to version 6.2.7 on the 6.x branch or 5.19.8 on the 5.x branch.
- Audit and reduce the set of accounts authorized to connect over the OpenWire transport.
- Restrict network reachability of OpenWire ports to trusted application hosts only.
Patch Information
Apache released fixed versions 5.19.8 and 6.2.7 that validate the encoded map size before allocating memory during OpenWire unmarshaling. Users on any prior 5.x or 6.x release should upgrade. See the Apache Security Mailing List Thread for the official announcement.
Workarounds
- Rotate and revoke credentials for any OpenWire user accounts that are not strictly required.
- Enforce network segmentation and firewall ACLs so only application services can reach the broker's OpenWire port.
- Configure the JVM with -XX:+ExitOnOutOfMemoryError and process supervision to accelerate recovery until patching is completed.
# Example: restrict OpenWire access with iptables until patching completes
iptables -A INPUT -p tcp --dport 61616 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 61616 -j DROP
# Verify installed ActiveMQ version
$ACTIVEMQ_HOME/bin/activemq --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
