CVE-2026-53916

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 0.74%
EPSS Percentile: 53.41%
CISA KEV: Not listed

Description

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security@apache.org
Published: 30-Jun-2026 18:16
Last Modified: 03-Jul-2026 01:42
EPSS Date: 2026-10-13
CWE: CWE-789

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:N /
                            A:H

Affected Products / Versions

apache / activemq
Version / affected range: * · before (exclusive) 5.19.8
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
apache / activemq
Version / affected range: * · from (inclusive) 6.0.0 · before (exclusive) 6.2.7
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*

References

Last enrichment sync: 14-Oct-2026 11:24
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Apache disclosed a STOMP-specific denial-of-service flaw (CVE-2026-53916) in its security advisories this year. Censys Adds 22 Scanners to Map Internet-Exposed Services

CVE (1)

Threat Actors (1)

Vendors (4)

Products (7)

Industries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.