CVE-2026-103582

Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0. The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did not check that decoded lengths fit within the frame being read. A malicious or compromised broker, or an attacker able to intercept and modify an unencrypted connection, could send a crafted OpenWire frame with an oversized or negative length. This could cause the client to attempt very large memory allocations, leading to excessive memory consumption, an OutOfMemoryException or an uncaught exception, and a denial of service of the client application. Users are recommended to upgrade to version 2.3.0, which enforces a configurable maximum frame size and validates lengths against the size of the frame being read.

• CWE-789

• https://lists.apache.org/thread/vgn9pnsc7g9dhcctt804kd50tvs0ndq0
• https://www.openwall.com/lists/oss-security/2026/11/03/15

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103569Out-of-bounds read in Windows IKE Extension allows an unauth…7.5
• CVE-2026-103572Improper control of generation of code ('code injection') in…8.8
• CVE-2026-103575Use after free in Remote Desktop Client allows an unauthoriz…8.8
• CVE-2026-103576Url redirection to untrusted site ('open redirect') in Activ…6.5
• CVE-2026-103577Insecure default variable initialization in Microsoft QUIC a…7.5
• CVE-2026-103578Untrusted pointer dereference in Windows Kernel allows an un…6.8
• CVE-2026-103584Improper neutralization of Script-Related HTML tags in a web…1.1
• CVE-2026-103585Improper neutralization of Script-Related HTML tags in a web…1.2
• CVE-2026-103587QloApps through 1.7.0 contains a reflected cross-site script…5.4
• CVE-2026-103588QloApps through 1.7.0 contains a reflected cross-site script…5.4
• CVE-2026-103589QloApps through 1.7.0 contains a reflected cross-site script…5.4
• CVE-2026-103590QloApps through 1.7.0 contains a reflected cross-site script…5.4