CVE-2026-53917

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53917
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53917.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53917
Aliases
Downstream
Published
2026-06-30T09:49:17.388Z
Modified
2026-07-08T08:13:44.797953608Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling
Details

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.

An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                },
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                },
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                },
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                },
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                },
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                },
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53917.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-789"
    ]
}
References

Affected packages

Git / github.com/apache/activemq

Affected ranges

Type
GIT
Repo
https://github.com/apache/activemq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7d56ebc8e04dd0a2a14545cfa05883f9bdba72a2
Introduced
14bac13f40958c1a1d3d198051eed32facc4abd1
Fixed
f3e61919b374ee5b124f80458334c314fc2cb29d
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.19.8"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.2.7"
        }
    ]
}

Affected versions

activemq-5.*
activemq-5.10.0
activemq-5.11.0
activemq-5.12.0
activemq-5.13.0
activemq-5.14.0
activemq-5.15.0
activemq-5.16.0
activemq-5.18.0
activemq-5.18.1
activemq-5.18.2
activemq-5.18.3
activemq-5.18.4
activemq-5.18.5
activemq-5.18.6
activemq-5.19.0
activemq-5.19.1
activemq-5.19.2
activemq-5.9.0
activemq-6.*
activemq-6.0.0
activemq-6.1.0
activemq-6.1.1
activemq-6.1.2
activemq-6.2.0
activemq-6.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53917.json"