CVE-2026-59878: 
Apache ActiveMQ Classic vulnerability analysis and mitigation

CVE-2026-59878 is an Improper Input Validation vulnerability in Apache ActiveMQ's AMQP NIO connector that allows a remote unauthenticated attacker to trigger denial-of-service (DoS) by sending a malformed (negative) frame size value, causing NIO worker threads to die and potentially exhausting the thread pool. It affects Apache ActiveMQ, Apache ActiveMQ AMQP, and Apache ActiveMQ All in versions before 5.19.9 and from 6.0.0 before 6.2.8. The vulnerability was disclosed on July 27, 2026, by Christopher L. Shannon of the Apache Software Foundation, with credit to researcher "zx (Jace)" as the finder. It carries a CVSS v3.1 base score of 7.5 (High) (OSS-Sec, GitHub Advisory).

The root cause is classified as CWE-20 (Improper Input Validation): the AMQP NIO connector in Apache ActiveMQ fails to properly validate the frame size value received from a remote peer, allowing negative or otherwise malformed values to be processed. When such a value is sent, the NIO worker thread handling the connection terminates abnormally; if this is repeated rapidly, the entire NIO thread pool can be exhausted, blocking all subsequent connections to the broker. The attack requires no authentication and no user interaction — only network reachability to the exposed AMQP NIO connector port. No public proof-of-concept code has been identified at this time (OSS-Sec, GitHub Advisory).

Successful exploitation results in a complete denial of service to the Apache ActiveMQ message broker: NIO threads crash and the thread pool is exhausted, rendering the broker unavailable to all legitimate clients and connections. There is no confidentiality or integrity impact — the vulnerability is limited to availability. In environments where ActiveMQ serves as a critical messaging backbone, exploitation could disrupt dependent applications, pipelines, or microservices relying on the broker for communication (OSS-Sec, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time, as confirmed by the Feedly executive summary and NVD SSVC assessment (exploitation: none). The EPSS score is approximately 0.55–0.88% (56th percentile), indicating a moderate but not elevated near-term exploitation probability. The vulnerability is automatable (no user interaction or authentication required), which lowers the barrier for opportunistic attackers. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, OSS-Sec).

1. Reconnaissance: Identify internet-facing or network-accessible Apache ActiveMQ instances running vulnerable versions (before 5.19.9 or 6.0.0–6.2.7) using tools like Shodan, Censys, or Nmap, targeting the default AMQP NIO connector port (typically TCP 5672).
2. Establish connection: Open a TCP connection to the exposed AMQP NIO connector port without providing any credentials, as authentication is not required.
3. Send malformed frame: Transmit an AMQP frame containing a negative or otherwise invalid frame size value in the frame header, bypassing the broker's input validation.
4. Crash NIO thread: The NIO worker thread processing the malformed frame terminates abnormally due to the invalid frame size.
5. Repeat rapidly: Rapidly repeat steps 2–4 across multiple connections to exhaust the NIO thread pool, preventing the broker from accepting or processing any further connections and achieving a full denial of service (OSS-Sec, GitHub Advisory).

• Network: Unusual volume of short-lived TCP connections to the AMQP NIO connector port (default 5672) from one or more source IPs; connections that terminate abnormally without completing the AMQP handshake.
• Logs: ActiveMQ broker logs showing repeated NIO thread exceptions or stack traces related to invalid frame size parsing; log entries indicating NIO thread pool exhaustion or thread death events.
• Process/Service: ActiveMQ broker becoming unresponsive or refusing new connections while the process remains running; monitoring alerts for thread pool saturation on the broker JVM.
• Application: Downstream applications or consumers reporting connection failures or timeouts to the ActiveMQ broker coinciding with the above network activity (OSS-Sec).

The primary remediation is to upgrade Apache ActiveMQ to version 5.19.9, 6.2.8, or 6.3.0, all of which include the fix for this vulnerability. If immediate patching is not feasible, restrict network access to the AMQP NIO connector port (default TCP 5672) to trusted networks or hosts only using firewall rules or network segmentation, and monitor for anomalous connection patterns. Organizations should also review whether the AMQP NIO connector is necessary and disable it if not in use (OSS-Sec, Apache Advisory).

The vulnerability was disclosed via the Apache security mailing list and oss-security by Christopher L. Shannon on July 27, 2026, and received brief social media attention on Bluesky and Mastodon shortly after disclosure. Security aggregators including Vulners, VulDB, and Tenable (Nessus plugins 330639 and 330836) picked up the advisory within 24–48 hours. Community reaction has been measured, consistent with the moderate severity rating and lack of active exploitation (OSS-Sec, Apache Advisory).