Unbounded Memory Allocation Vulnerability in Apache NMS ActiveMQ by Apache

CVE-2026-103582

What is CVE-2026-103582?

The OpenWire unmarshalling code in Apache NMS ActiveMQ prior to version 2.3.0 does not impose a maximum frame size or validate lengths properly. This oversight can lead to potential memory exhaustion when handling maliciously crafted OpenWire frames, resulting in Denial of Service (DoS) attacks. Attackers could exploit this vulnerability by sending oversized or improperly structured messages over an unencrypted connection, causing excessive memory usage and potential application crashes. Users are advised to upgrade to version 2.3.0 for enhanced protection through configurable maximum frame size enforcement and proper validation of message lengths.

References