CVE-2026-59878 Overview
CVE-2026-59878 is an Improper Input Validation vulnerability [CWE-20] affecting the Apache ActiveMQ AMQP NIO connector. A remote unauthenticated attacker who can reach an exposed AMQP NIO connector can send a crafted frame size value that causes NIO threads to die. Repeating the request rapidly exhausts the NIO thread pool and denies service to legitimate connections.
The issue affects Apache ActiveMQ AMQP, Apache ActiveMQ, and Apache ActiveMQ All in versions before 5.19.9 and from 6.0.0 before 6.2.8. Users should upgrade to 5.19.9, 6.2.8, or 6.3.0.
Critical Impact
Unauthenticated network attackers can exhaust the NIO thread pool of exposed Apache ActiveMQ AMQP brokers, denying service to all clients.
Affected Products
- Apache ActiveMQ AMQP: before 5.19.9, and 6.0.0 through 6.2.7
- Apache ActiveMQ: before 5.19.9, and 6.0.0 through 6.2.7
- Apache ActiveMQ All: before 5.19.9, and 6.0.0 through 6.2.7
Discovery Timeline
- 2026-07-28 - CVE-2026-59878 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-59878
Vulnerability Analysis
Apache ActiveMQ exposes an AMQP (Advanced Message Queuing Protocol) connector that uses Java non-blocking I/O (NIO) worker threads to handle incoming client frames. Each AMQP frame includes a size field parsed before the payload is read. The AMQP NIO connector does not properly validate this frame size value.
When an attacker sends a malformed frame size, the NIO worker thread encounters an unhandled condition and terminates. The connector does not recover the terminated worker, and the pool shrinks with each malicious frame. Sending such frames in rapid succession exhausts the pool and prevents ActiveMQ from serving new or existing AMQP connections.
The attack requires no authentication, no user interaction, and only network reachability to the AMQP listener (default port 5672). The impact is limited to availability; confidentiality and integrity are not affected.
Root Cause
The root cause is missing input validation on the AMQP frame size field within the NIO transport code path. The connector propagates parsing errors up the stack in a way that kills the NIO thread rather than closing only the offending connection. There is no isolation between per-connection error handling and the shared worker pool.
Attack Vector
An attacker establishes a TCP session to the exposed AMQP NIO connector and transmits AMQP frames containing an invalid or out-of-range frame size value. Each frame kills one worker thread. Automated tooling can send these frames at high rate from a single source, exhausting the pool within seconds and blocking all subsequent AMQP traffic to the broker.
Exploitation requires no credentials and no prior knowledge of the target queues or topics. Brokers exposed to untrusted networks or the internet are directly reachable targets. See the Apache Mailing List Discussion and the Openwall OSS-Security Update for the vendor advisory content.
Detection Methods for CVE-2026-59878
Indicators of Compromise
- Repeated TCP connections to the AMQP port (default 5672) from a single source that close abruptly after a small number of bytes.
- ActiveMQ broker logs showing recurring NIO transport exceptions or worker thread termination messages tied to AMQP frame parsing.
- Sudden drop in the number of active AMQP worker threads correlated with a spike in inbound connection attempts.
- Legitimate AMQP clients reporting timeouts, refused connections, or hung sessions against a broker that remains process-alive.
Detection Strategies
- Monitor JVM thread counts on ActiveMQ brokers and alert on rapid decreases in the NIO worker pool size.
- Parse activemq.log for repeated exceptions in the AMQP transport layer, particularly frame-decode errors from the same peer.
- Deploy network IDS rules that flag high-frequency short-lived TCP sessions to port 5672 from unauthorized source ranges.
Monitoring Recommendations
- Track AMQP connection establishment rate, connection failure rate, and worker-thread availability as continuous broker health metrics.
- Forward broker JMX metrics and logs to a centralized analytics platform for correlation with network telemetry.
- Alert on any inbound AMQP traffic originating outside the expected client subnet or service mesh.
How to Mitigate CVE-2026-59878
Immediate Actions Required
- Upgrade Apache ActiveMQ to version 5.19.9, 6.2.8, or 6.3.0, which contain the fix.
- Restrict network access to the AMQP connector so only trusted producer and consumer hosts can reach port 5672.
- Enumerate all ActiveMQ instances across environments and confirm whether the AMQP transport is enabled and exposed.
- Review broker logs for prior evidence of frame parsing exceptions that may indicate reconnaissance.
Patch Information
Apache has published fixed releases: 5.19.9, 6.2.8, and 6.3.0. All deployments running 5.x before 5.19.9 or 6.0.0 through 6.2.7 are vulnerable and must be updated. Refer to the Apache Mailing List Discussion for the official announcement.
Workarounds
- Disable the AMQP transport connector in activemq.xml if AMQP is not required by clients.
- Place the broker behind a network firewall or service mesh policy that allows AMQP only from allow-listed source addresses.
- Terminate AMQP at an authenticating proxy or gateway that validates frame structure before forwarding to the broker.
- Rate-limit inbound connections to port 5672 at the edge to slow exhaustion attempts while patching is scheduled.
# Configuration example: remove or comment the AMQP connector in conf/activemq.xml
# <transportConnector name="amqp" uri="amqp://0.0.0.0:5672?maximumConnections=1000&wireFormat.maxFrameSize=104857600"/>
# Restrict AMQP port at the host firewall (Linux example)
iptables -A INPUT -p tcp --dport 5672 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5672 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
