Apache ActiveMQ AMQP/ActiveMQ/ActiveMQ All up to 5.19.8/6.2.7 AMQP NIO Connector input validation

Summaryinfo

A vulnerability categorized as problematic has been discovered in Apache ActiveMQ AMQP, ActiveMQ and ActiveMQ All up to 5.19.8/6.2.7. The impacted element is an unknown function of the component AMQP NIO Connector. The manipulation results in input validation. This vulnerability is cataloged as CVE-2026-59878. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Apache ActiveMQ AMQP, ActiveMQ and ActiveMQ All up to 5.19.8/6.2.7. It has been classified as problematic. Affected is an unknown functionality of the component AMQP NIO Connector. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on availability. CVE summarizes:

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done rapidly enough can lead to exhaustion of the NIO thread pool denying service to other connections. This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8. Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which fixes the issue.

The advisory is available at lists.apache.org. This vulnerability is traded as CVE-2026-59878 since 07/07/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/28/2026).

Upgrading to version 5.19.9, 6.2.8 or 6.3.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• ActiveMQ
• ActiveMQ All
• ActiveMQ AMQP

Version

• 5.19.0
• 5.19.1
• 5.19.2
• 5.19.3
• 5.19.4
• 5.19.5
• 5.19.6
• 5.19.7
• 5.19.8
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion