ActiveMQ Memory Exhaustion via Unvalidated Message Size

Apache ActiveMQ contains a critical vulnerability in its OpenWire protocol implementation where authenticated users can trigger denial-of-service conditions by sending specially crafted messages with excessively large encoded size values in property maps. The vulnerability stems from unmarshaling OpenWire message maps without proper size validation, allowing attackers to allocate unbounded memory and exhaust broker resources, ultimately crashing the service. This affects multiple ActiveMQ versions (5.x before 5.19.8 and 6.x before 6.2.7) and impacts any organization relying on ActiveMQ for message brokering, particularly those with untrusted internal networks or exposed broker endpoints.

While no specific MITRE ATT&CK techniques are formally mapped to this CVE, Casky's AI-driven analysis would detect attack patterns consistent with resource exhaustion and denial-of-service activities. A practitioner using Casky would observe detection signals aligned with T1499 (Service Exhaustion DoS) and T1561 (Disk Content Wipe) patterns—specifically, anomalous memory allocation requests, abnormal process resource consumption spikes, and broker crash events following authenticated OpenWire message submissions. By correlating message parsing logs, memory utilization baselines, and authentication events, Casky's extended reasoning capabilities would surface the attack chain: legitimate authentication followed by crafted message transmission triggering uncontrolled memory allocation. Security teams would see findings indicating suspicious authenticated session behavior with resource exhaustion indicators, enabling rapid differentiation between legitimate traffic spikes and exploit attempts.