CVE-2026-53917
Last modified
CVE-2026-53917 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.. EPSS estimates a 0.52% chance of exploitation in the next 30 days.
Description
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Activemq | < 5.19.8 |
| Apache | Activemq | >= 6.0.0, < 6.2.7 |
| Apache | Activemq Broker | < 5.19.8 |
| Apache | Activemq Broker | >= 6.0.0, < 6.2.7 |
References
- http://www.openwall.com/lists/oss-security/2026/06/29/14Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-53917?
How severe is CVE-2026-53917?
How do I fix CVE-2026-53917?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-53911Cerebrate before version 1.37 allowed the id primary key fie…6.3
- CVE-2026-53912Cerebrate before version 1.37 exposed credential material fr…5.1
- CVE-2026-53913Improper Authentication, Missing Authentication for Critical…9.8
- CVE-2026-53914In JetBrains Kotlin before 2.4.20 code execution was possibl…9.8
- CVE-2026-53915In JetBrains GoLand before 2026.1.3 remote code execution wa…8.8
- CVE-2026-53916Memory Allocation with Excessive Size Value vulnerability in…7.5
- CVE-2026-5392Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 me…5.4
- CVE-2026-53923vLLM is an inference and serving engine for large language m…7.5
- CVE-2026-53925Glances is an open-source system cross-platform monitoring t…7.8
- CVE-2026-53926NocoDB is software for building databases as spreadsheets. P…6.3
- CVE-2026-53927NocoDB is software for building databases as spreadsheets. P…5.1
- CVE-2026-53928NocoDB is software for building databases as spreadsheets. P…6.3
Are you affected by CVE-2026-53917?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST