Memory Allocation Issue in Apache ActiveMQ and Its Variants

CVE-2026-53916

What is CVE-2026-53916?

A memory allocation vulnerability exists in Apache ActiveMQ due to the handling of header bytes sent from an unauthenticated client over a STOMP NIO connection. This flaw allows for excessive header size values, leading to unlimited buffering by the broker, which can ultimately exhaust the Java Virtual Machine (JVM) heap. It is crucial for users to update to version 6.2.7 or 5.19.8 to mitigate this issue effectively.

References