CVE-2026-59878: Apache ActiveMQ AMQP Denial-of-Service Vulnerability Due to Negative Frame Size Validation Bypass
Summary
CVE-2026-59878: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. Affects activemq across 2 version ranges.
< 5.19.9
>= 6.0.0, < 6.2.8
Fixed in 5.19.9 or 6.2.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source messaging server that facilitates communication between applications through a variety of protocols, including AMQP (Advanced Message Queuing Protocol). It is widely used for its reliability and scalability in enterprise environments. However, certain versions of ActiveMQ are vulnerable to a denial-of-service (DoS) attack due to improper input validation in the AMQP NIO connector, allowing malicious actors to exploit this weakness.
Vulnerability Detail
The vulnerability arises from improper input validation in the Apache ActiveMQ AMQP implementation. A remote unauthenticated peer can send a specially crafted frame size value to an exposed AMQP NIO connector. This can cause the NIO threads to crash, leading to exhaustion of the NIO thread pool. If exploited rapidly, this can result in a denial of service for legitimate users, preventing them from establishing connections to the server. This issue affects versions of Apache ActiveMQ AMQP prior to 5.19.9 and from 6.0.0 before 6.2.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.19.95.19.9 -
>= 6.0.0, < 6.2.86.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can restrict access to the AMQP NIO connector by implementing firewall rules or network access controls to limit exposure to trusted IP addresses only. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
CVE-2026-59878 represents a significant risk for users of Apache ActiveMQ, particularly those using vulnerable versions. It is crucial to upgrade to the recommended patched versions to mitigate the risk of denial-of-service attacks. Additionally, implementing network access controls can provide temporary protection while updates are applied.
See every vulnerability recorded for activemq →
FAQ
CVE-2026-59878 is a vulnerability in Apache ActiveMQ that allows for denial-of-service attacks due to improper input validation in the AMQP NIO connector.
Versions of Apache ActiveMQ AMQP before 5.19.9 and from 6.0.0 before 6.2.8 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to denial-of-service conditions, preventing legitimate users from connecting to the ActiveMQ server.
If an immediate upgrade is not possible, implement network access controls to limit exposure to the AMQP NIO connector as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
