Input validation error in ActiveMQ - CVE-2026-59878
Published: August 24, 2026
Vulnerability identifier: #VU144756
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59878
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the AMQP NIO connector when processing a crafted frame size value. A remote attacker can send a specially crafted frame to cause a denial of service.
If triggered rapidly enough, the issue can exhaust the NIO thread pool and deny service to other connections.
Affected software
ActiveMQ
IBM Sterling Control Center
openEuler
activemq
activemq-javadoc
IBM Sterling Control Center
openEuler
activemq
activemq-javadoc
How to mitigate CVE-2026-59878
Install security update from vendor's website.
ActiveMQ - addressed in versions 5.19.9, 6.2.8, 6.3.0
IBM Sterling Control Center - addressed in versions 6.3.1.0.11, 6.4.2.0.7
activemq - update to 5.19.9-1
activemq-javadoc - update to 5.19.9-1
IBM Sterling Control Center - addressed in versions 6.3.1.0.11, 6.4.2.0.7
activemq - update to 5.19.9-1
activemq-javadoc - update to 5.19.9-1