GHSA-xjwq-9jw5-jf7w

Suggest an improvement
Source
https://github.com/advisories/GHSA-xjwq-9jw5-jf7w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xjwq-9jw5-jf7w
Aliases
Downstream
MINI (4)
Published
2026-06-30T12:31:52Z
Modified
2026-11-05T17:56:07Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability
Details

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.

A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-20",
        "CWE-839"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-05T17:33:52Z",
    "nvd_published_at": "2026-06-30T11:16:29Z",
    "severity": "HIGH"
}
References

Affected packages

Maven
org.apache.activemq:apache-activemq

Package

Name
org.apache.activemq:apache-activemq
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.19.8

Affected versions

4.*
4.1.1
4.1.2
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.4.3
5.5.0
5.5.1
5.6.0
5.7.0
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.15.0
5.15.1
5.15.2
5.15.3
5.15.4
5.15.5
5.15.6
5.15.7
5.15.8
5.15.9
5.15.10
5.15.11
5.15.12
5.15.13
5.15.14
5.15.15
5.15.16
5.16.0
5.16.1
5.16.2
5.16.3
5.16.4
5.16.5
5.16.6
5.16.7
5.16.8
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.17.5
5.17.6
5.17.7
5.18.0
5.18.1
5.18.2
5.18.3
5.18.4
5.18.5
5.18.6
5.18.7
5.19.0
5.19.1
5.19.2
5.19.3
5.19.4
5.19.5
5.19.6
5.19.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json"
org.apache.activemq:apache-activemq

Package

Name
org.apache.activemq:apache-activemq
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.2.7

Affected versions

6.*
6.0.0
6.0.1
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json"
org.apache.activemq:activemq-all

Package

Name
org.apache.activemq:activemq-all
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-all

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.19.8

Affected versions

4.*
4.1.2
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.4.3
5.5.0
5.5.1
5.6.0
5.7.0
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.15.0
5.15.1
5.15.2
5.15.3
5.15.4
5.15.5
5.15.6
5.15.7
5.15.8
5.15.9
5.15.10
5.15.11
5.15.12
5.15.13
5.15.14
5.15.15
5.15.16
5.16.0
5.16.1
5.16.2
5.16.3
5.16.4
5.16.5
5.16.6
5.16.7
5.16.8
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.17.5
5.17.6
5.17.7
5.18.0
5.18.1
5.18.2
5.18.3
5.18.4
5.18.5
5.18.6
5.18.7
5.19.0
5.19.1
5.19.2
5.19.3
5.19.4
5.19.5
5.19.6
5.19.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json"
org.apache.activemq:activemq-all

Package

Name
org.apache.activemq:activemq-all
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-all

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.2.7

Affected versions

6.*
6.0.0
6.0.1
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json"
org.apache.activemq:activemq-stomp

Package

Name
org.apache.activemq:activemq-stomp
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-stomp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.19.8

Affected versions

5.*
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.15.0
5.15.1
5.15.2
5.15.3
5.15.4
5.15.5
5.15.6
5.15.7
5.15.8
5.15.9
5.15.10
5.15.11
5.15.12
5.15.13
5.15.14
5.15.15
5.15.16
5.16.0
5.16.1
5.16.2
5.16.3
5.16.4
5.16.5
5.16.6
5.16.7
5.16.8
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.17.5
5.17.6
5.17.7
5.18.0
5.18.1
5.18.2
5.18.3
5.18.4
5.18.5
5.18.6
5.18.7
5.19.0
5.19.1
5.19.2
5.19.3
5.19.4
5.19.5
5.19.6
5.19.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json"
org.apache.activemq:activemq-stomp

Package

Name
org.apache.activemq:activemq-stomp
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-stomp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.2.7

Affected versions

6.*
6.0.0
6.0.1
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json"