Christopher L. Shannon

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.

Improper input validation occurs when a user creates a durable subscription. If the combined length of the `clientId` and subscription name exceeds 65,535 characters, it can cause a broker using KahaDB to shut down and become unrecoverable.

The issue is related to a Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands, the size value of buffers was not properly validated, which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory. This affects applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. It is estimated that over 41.9 million services may be affected.