CVE-2026-49432

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

• CWE-20

• https://lists.apache.org/thread/fsjb26605syqr8xks249h8gkp86t55d2Vendor Advisory, Mailing List
• http://www.openwall.com/lists/oss-security/2026/06/29/7Third Party Advisory

Published

Jun 30, 2026

Last Modified

Jul 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49412The kernel handler for IPV6_MSFILTER dropped a serializing l…7.8
• CVE-2026-49413The Linuxulator determined whether a binary was set-user-ID …7.1
• CVE-2026-49414The ELF image activator cleared per-process ASLR preference …7.8
• CVE-2026-49416The CONS_HISTORY ioctl handler did not adequately validate t…7.8
• CVE-2026-49417Second, the audio buffer backing a mapping could be freed wh…7
• CVE-2026-4942IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…5.9
• CVE-2026-49433The DeepAI endpoint 'https://api.deepai.org/change_user_emai…5
• CVE-2026-49434Improper Input Validation vulnerability in Apache ActiveMQ B…7.5
• CVE-2026-49435Keysight IxChariot Endpoint and associated products contain …9.8
• CVE-2026-4944vllm-project/vllm version 0.14.1 contains a vulnerability wh…8.8
• CVE-2026-49440Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…7.4
• CVE-2026-49443authentik is an open-source identity provider. Prior to vers…8.8