ActiveMQ STOMP Unbounded Memory Allocation Denial of Service

CVE-2026-53916 exploits a memory allocation vulnerability in Apache ActiveMQ's STOMP protocol implementation, where unauthenticated clients can send indefinitely long header bytes that the broker buffers without limits. This causes progressive JVM heap exhaustion, leading to denial of service. The vulnerability affects ActiveMQ versions before 5.19.8 and 6.0.0 through 6.2.6, making any organization running these versions vulnerable to remote, unauthenticated attacks. The lack of authentication requirements means this can be exploited by any network-adjacent attacker with connectivity to the STOMP port, making it a critical availability risk for message broker infrastructure.

While this CVE does not map directly to established MITRE ATT&CK techniques, Casky's AI-driven analysis would detect attack patterns associated with resource exhaustion and protocol abuse. Practitioners using Casky would identify reconnaissance indicators (connection attempts to standard STOMP ports), followed by anomalous header transmission patterns showing progressively larger or non-terminating payloads. The extended reasoning capabilities would correlate these observations with CWE-789 (Memory Allocation with Excessive Size Value), helping security teams recognize the characteristic signature of unbounded buffering attacks. Detection rules would flag unusual STOMP session behavior—specifically clients that open connections but fail to properly complete protocol handshakes while transmitting excessive header data—enabling early intervention before heap exhaustion becomes critical.