org.apache.activemq:activemq-stomp@6.2.6

latest version

6.3.0

latest non vulnerable version

6.3.0

first published

13 years ago

latest version published

10 days ago

licenses detected

Apache-2.0
[5.8.0,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.activemq:activemq-stomp package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Incorrect Calculation of Buffer Size Affected versions of this package are vulnerable to Incorrect Calculation of Buffer Size via the `STOMP` protocol when a remote unauthenticated peer sends a negative `content-length` value. An attacker can exhaust system resources or force abnormal connection closure by continuously streaming body bytes, causing the per-connection command buffer to exceed configured limits or triggering transport exception handling. How to fix Incorrect Calculation of Buffer Size? Upgrade `org.apache.activemq:activemq-stomp` to version 5.19.8, 6.2.7 or higher.	[,5.19.8)[6.0.0,6.2.7)
H Memory Allocation with Excessive Size Value Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the `STOMP NIO codec` process. An attacker can cause the broker to buffer unbounded header data, leading to exhaustion of the JVM heap by sending header bytes that never terminate over a STOMP NIO connection. How to fix Memory Allocation with Excessive Size Value? Upgrade `org.apache.activemq:activemq-stomp` to version 5.19.8, 6.2.7 or higher.	[,5.19.8)[6.0.0,6.2.7)

Incorrect Calculation of Buffer Size

Affected versions of this package are vulnerable to Incorrect Calculation of Buffer Size via the STOMP protocol when a remote unauthenticated peer sends a negative content-length value. An attacker can exhaust system resources or force abnormal connection closure by continuously streaming body bytes, causing the per-connection command buffer to exceed configured limits or triggering transport exception handling.

How to fix Incorrect Calculation of Buffer Size?

Upgrade org.apache.activemq:activemq-stomp to version 5.19.8, 6.2.7 or higher.

[,5.19.8)[6.0.0,6.2.7)

Memory Allocation with Excessive Size Value

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the STOMP NIO codec process. An attacker can cause the broker to buffer unbounded header data, leading to exhaustion of the JVM heap by sending header bytes that never terminate over a STOMP NIO connection.

How to fix Memory Allocation with Excessive Size Value?

Upgrade org.apache.activemq:activemq-stomp to version 5.19.8, 6.2.7 or higher.

[,5.19.8)[6.0.0,6.2.7)

Go back to all versions of this package