ghsa-f77w-px59-cqf5
CVSS 7.5 osv_maven
Description
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-53917
- https://github.com/apache/activemq/pull/2136
- https://github.com/apache/activemq/commit/78bb8dcdc32e80c8b8813b57f89147572d16a2b9
- https://github.com/apache/activemq/commit/b20e61c7ef736a04ad07a934ea8de628550c6cf2
- https://github.com/apache/activemq/commit/ecfd1336fa3f3f6116a78f0ab71d1b2f90bc717f
- https://github.com/apache/activemq
- https://github.com/apache/activemq/releases/tag/activemq-5.19.8
- https://github.com/apache/activemq/releases/tag/activemq-6.2.7
- https://lists.apache.org/thread/grrd1mwgkgblqjbwkkq6dvmdxd9ov2dx
- http://www.openwall.com/lists/oss-security/2026/06/29/14
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:apache-activemq",
"purl": "pkg:maven/org.apache.activemq/apache-activemq"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.19.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.1.1",
"4.1.2",
"5.0.0",
"5.1.0",
"5.10.0",
"5.10.1",
"5.10.2",
"5.11.0",
"5.11.1",
"5.11.2",
"5.11.3",
"5.11.4",
"5.12.0",
"5.12.1",
"5.12.2",
"5.12.3",
"5.13.0",
"5.13.1",
"5.13.2",
"5.13.3",
"5.13.4",
"5.13.5",
"5.14.0",
"5.14.1",
"5.14.2",
"5.14.3",
"5.14.4",
"5.14.5",
"5.15.0",
"5.15.1",
"5.15.10",
"5.15.11",
"5.15.12",
"5.15.13",
"5.15.14",
"5.15.15",
"5.15.16",
"5.15.2",
"5.15.3",
"5.15.4",
"5.15.5",
"5.15.6",
"5.15.7",
"5.15.8",
"5.15.9",
"5.16.0",
"5.16.1",
"5.16.2",
"5.16.3",
"5.16.4",
"5.16.5",
"5.16.6",
"5.16.7",
"5.16.8",
"5.17.0",
"5.17.1",
"5.17.2",
"5.17.3",
"5.17.4",
"5.17.5",
"5.17.6",
"5.17.7",
"5.18.0",
"5.18.1",
"5.18.2",
"5.18.3",
"5.18.4",
"5.18.5",
"5.18.6",
"5.18.7",
"5.19.0",
"5.19.1",
"5.19.2",
"5.19.3",
"5.19.4",
"5.19.5",
"5.19.6",
"5.19.7",
"5.2.0",
"5.3.0",
"5.3.1",
"5.3.2",
"5.4.0",
"5.4.1",
"5.4.2",
"5.4.3",
"5.5.0",
"5.5.1",
"5.6.0",
"5.7.0",
"5.8.0",
"5.9.0",
"5.9.1"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:apache-activemq",
"purl": "pkg:maven/org.apache.activemq/apache-activemq"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.2.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.0.0",
"6.0.1",
"6.1.0",
"6.1.1",
"6.1.2",
"6.1.3",
"6.1.4",
"6.1.5",
"6.1.6",
"6.1.7",
"6.1.8",
"6.2.0",
"6.2.1",
"6.2.2",
"6.2.3",
"6.2.4",
"6.2.5",
"6.2.6"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-all",
"purl": "pkg:maven/org.apache.activemq/activemq-all"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.19.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.1.2",
"5.0.0",
"5.1.0",
"5.10.0",
"5.10.1",
"5.10.2",
"5.11.0",
"5.11.1",
"5.11.2",
"5.11.3",
"5.11.4",
"5.12.0",
"5.12.1",
"5.12.2",
"5.12.3",
"5.13.0",
"5.13.1",
"5.13.2",
"5.13.3",
"5.13.4",
"5.13.5",
"5.14.0",
"5.14.1",
"5.14.2",
"5.14.3",
"5.14.4",
"5.14.5",
"5.15.0",
"5.15.1",
"5.15.10",
"5.15.11",
"5.15.12",
"5.15.13",
"5.15.14",
"5.15.15",
"5.15.16",
"5.15.2",
"5.15.3",
"5.15.4",
"5.15.5",
"5.15.6",
"5.15.7",
"5.15.8",
"5.15.9",
"5.16.0",
"5.16.1",
"5.16.2",
"5.16.3",
"5.16.4",
"5.16.5",
"5.16.6",
"5.16.7",
"5.16.8",
"5.17.0",
"5.17.1",
"5.17.2",
"5.17.3",
"5.17.4",
"5.17.5",
"5.17.6",
"5.17.7",
"5.18.0",
"5.18.1",
"5.18.2",
"5.18.3",
"5.18.4",
"5.18.5",
"5.18.6",
"5.18.7",
"5.19.0",
"5.19.1",
"5.19.2",
"5.19.3",
"5.19.4",
"5.19.5",
"5.19.6",
"5.19.7",
"5.2.0",
"5.3.0",
"5.3.1",
"5.3.2",
"5.4.0",
"5.4.1",
"5.4.2",
"5.4.3",
"5.5.0",
"5.5.1",
"5.6.0",
"5.7.0",
"5.8.0",
"5.9.0",
"5.9.1"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-all",
"purl": "pkg:maven/org.apache.activemq/activemq-all"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.2.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.0.0",
"6.0.1",
"6.1.0",
"6.1.1",
"6.1.2",
"6.1.3",
"6.1.4",
"6.1.5",
"6.1.6",
"6.1.7",
"6.1.8",
"6.2.0",
"6.2.1",
"6.2.2",
"6.2.3",
"6.2.4",
"6.2.5",
"6.2.6"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-client",
"purl": "pkg:maven/org.apache.activemq/activemq-client"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.19.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.10.0",
"5.10.1",
"5.10.2",
"5.11.0",
"5.11.1",
"5.11.2",
"5.11.3",
"5.11.4",
"5.12.0",
"5.12.1",
"5.12.2",
"5.12.3",
"5.13.0",
"5.13.1",
"5.13.2",
"5.13.3",
"5.13.4",
"5.13.5",
"5.14.0",
"5.14.1",
"5.14.2",
"5.14.3",
"5.14.4",
"5.14.5",
"5.15.0",
"5.15.1",
"5.15.10",
"5.15.11",
"5.15.12",
"5.15.13",
"5.15.14",
"5.15.15",
"5.15.16",
"5.15.2",
"5.15.3",
"5.15.4",
"5.15.5",
"5.15.6",
"5.15.7",
"5.15.8",
"5.15.9",
"5.16.0",
"5.16.1",
"5.16.2",
"5.16.3",
"5.16.4",
"5.16.5",
"5.16.6",
"5.16.7",
"5.16.8",
"5.17.0",
"5.17.1",
"5.17.2",
"5.17.3",
"5.17.4",
"5.17.5",
"5.17.6",
"5.17.7",
"5.18.0",
"5.18.1",
"5.18.2",
"5.18.3",
"5.18.4",
"5.18.5",
"5.18.6",
"5.18.7",
"5.19.0",
"5.19.1",
"5.19.2",
"5.19.3",
"5.19.4",
"5.19.5",
"5.19.6",
"5.19.7",
"5.8.0",
"5.9.0",
"5.9.1"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-client",
"purl": "pkg:maven/org.apache.activemq/activemq-client"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.2.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.0.0",
"6.0.1",
"6.1.0",
"6.1.1",
"6.1.2",
"6.1.3",
"6.1.4",
"6.1.5",
"6.1.6",
"6.1.7",
"6.1.8",
"6.2.0",
"6.2.1",
"6.2.2",
"6.2.3",
"6.2.4",
"6.2.5",
"6.2.6"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-broker",
"purl": "pkg:maven/org.apache.activemq/activemq-broker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.19.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.10.0",
"5.10.1",
"5.10.2",
"5.11.0",
"5.11.1",
"5.11.2",
"5.11.3",
"5.11.4",
"5.12.0",
"5.12.1",
"5.12.2",
"5.12.3",
"5.13.0",
"5.13.1",
"5.13.2",
"5.13.3",
"5.13.4",
"5.13.5",
"5.14.0",
"5.14.1",
"5.14.2",
"5.14.3",
"5.14.4",
"5.14.5",
"5.15.0",
"5.15.1",
"5.15.10",
"5.15.11",
"5.15.12",
"5.15.13",
"5.15.14",
"5.15.15",
"5.15.16",
"5.15.2",
"5.15.3",
"5.15.4",
"5.15.5",
"5.15.6",
"5.15.7",
"5.15.8",
"5.15.9",
"5.16.0",
"5.16.1",
"5.16.2",
"5.16.3",
"5.16.4",
"5.16.5",
"5.16.6",
"5.16.7",
"5.16.8",
"5.17.0",
"5.17.1",
"5.17.2",
"5.17.3",
"5.17.4",
"5.17.5",
"5.17.6",
"5.17.7",
"5.18.0",
"5.18.1",
"5.18.2",
"5.18.3",
"5.18.4",
"5.18.5",
"5.18.6",
"5.18.7",
"5.19.0",
"5.19.1",
"5.19.2",
"5.19.3",
"5.19.4",
"5.19.5",
"5.19.6",
"5.19.7",
"5.8.0",
"5.9.0",
"5.9.1"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-broker",
"purl": "pkg:maven/org.apache.activemq/activemq-broker"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.2.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.0.0",
"6.0.1",
"6.1.0",
"6.1.1",
"6.1.2",
"6.1.3",
"6.1.4",
"6.1.5",
"6.1.6",
"6.1.7",
"6.1.8",
"6.2.0",
"6.2.1",
"6.2.2",
"6.2.3",
"6.2.4",
"6.2.5",
"6.2.6"
]
}
],
"aliases": [
"BIT-activemq-2026-53917",
"CVE-2026-53917"
],
"database_specific": {
"cwe_ids": [
"CWE-789"
],
"github_reviewed": true,
"github_reviewed_at": "2026-11-04T16:10:26Z",
"nvd_published_at": "2026-06-30T11:16:30Z",
"severity": "HIGH"
},
"details": "Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.\n\nAn authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker.\nThis issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.",
"id": "GHSA-f77w-px59-cqf5",
"modified": "2026-11-04T16:25:37.959330560Z",
"published": "2026-06-30T12:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53917"
},
{
"type": "WEB",
"url": "https://github.com/apache/activemq/pull/2136"
},
{
"type": "WEB",
"url": "https://github.com/apache/activemq/commit/78bb8dcdc32e80c8b8813b57f89147572d16a2b9"
},
{
"type": "WEB",
"url": "https://github.com/apache/activemq/commit/b20e61c7ef736a04ad07a934ea8de628550c6cf2"
},
{
"type": "WEB",
"url": "https://github.com/apache/activemq/commit/ecfd1336fa3f3f6116a78f0ab71d1b2f90bc717f"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/activemq"
},
{
"type": "WEB",
"url": "https://github.com/apache/activemq/releases/tag/activemq-5.19.8"
},
{
"type": "WEB",
"url": "https://github.com/apache/activemq/releases/tag/activemq-6.2.7"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/grrd1mwgkgblqjbwkkq6dvmdxd9ov2dx"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/06/29/14"
}
],
"schema_version": "1.9.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability"
}