Apache ActiveMQ NMS OpenWire Client Library DoS via unbounded length fields (CVE-2026-103582)
Original title: CVE-2026-103582: Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)
The .NET OpenWire client before 2.3.0 allows remote denial of service by unvalidated frame sizes in unmarshalling.
Unbounded memory allocation occurs in the Apache NMS ActiveMQ OpenWire client when processing network frames. The code trusts length and count fields without maximum limits or validation. This affects the client library versions listed.
Impact: remote denial of service
- CVEs
- CVE-2026-103582
- Vendors
- Apache
- Products
- NMS OpenWire Client Library
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103582 | Unbounded memory allocation in Apache.NMS.ActiveMQ before 2.3.0 | 7.5 | — |
From the original article
Posted by Christopher L. Shannon on Nov 03 Severity: low Affected versions: - Apache ActiveMQ NMS OpenWire Client Library through 2. 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.