Apache ActiveMQ STOMP Negative Content-Length DoS

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will instead force abnormal transport exception handling for the affected connection and closure. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Apache ActiveMQ's STOMP connector contains an improper input validation flaw (CWE-20) that allows unauthenticated remote attackers to trigger denial-of-service conditions. By sending crafted STOMP protocol messages with negative content-length values, attackers can exploit both NIO and blocking transport implementations. In NIO mode, the vulnerability enables unbounded buffer growth and out-of-memory (OOM) conditions; in blocking mode, transport exceptions occur. Any organization exposing STOMP connectors to untrusted networks—including cloud deployments, containerized environments, and internet-facing message brokers—faces service disruption risks without proper network segmentation or input validation controls.

Casky's 322 aligned security skills leverage Claude's extended reasoning to detect exploitation patterns across the MITRE ATT&CK initial access (TA0001) and resource development (TA0043) phases. Practitioners using Casky would identify suspicious activity including: malformed STOMP frames with invalid content-length headers, anomalous per-connection memory consumption spikes, repeated transport exceptions from single sources, and protocol-level fuzzing attempts. The platform's skill mapping enables detection of reconnaissance activities (ATT&CK TA0043) probing STOMP availability, followed by exploitation attempts (TA0001) delivering crafted payloads. Security teams gain visibility into which connections attempt negative values, enabling rapid isolation before OOM events cascade across broker infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-49432.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-49432

Casky has 322 skills that investigate the attack patterns behind CVE-2026-49432. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn