HIGHFixed upstream

CVE-2026-59878

Apache ActiveMQ AMQP NIO connector threads die on a crafted frame size

Technology

Apache ActiveMQ

CVSS Score

7.5 / 10.0

Affected Versions

before 5.19.9; 6.0.0 before 6.2.8

Upstream Fix

5.19.9, 6.2.8 and 6.3.0

Published

July 28, 2026

OSSeva Coverage

Fixed upstream

Description

A remote, unauthenticated peer that can reach an AMQP NIO connector can send a frame size value that kills the NIO thread handling it. Repeated quickly, this exhausts the NIO thread pool and denies service to other connections. Apache rates the issue moderate; the 7.5 score on NVD is from CISA-ADP.

Upstream record: NVD · CVE.org

Is your Apache ActiveMQ deployment affected?

If you're running before 5.19.9; 6.0.0 before 6.2.8, you need this patch. Book a discovery call to get covered.

Book a discovery call View Apache ActiveMQ coverage →