CVE-2026-49432 describes an improper input validation vulnerability (CWE-20) in Apache ActiveMQ's STOMP connector. A remote unauthenticated attacker can send a negative content-length value to trigger denial-of-service conditions. For the NIO STOMP transport, this allows continuous streaming of body bytes, causing the per-connection command buffer to grow beyond configured limits and potentially leading to out-of-memory (OOM) conditions. For the blocking STOMP transport, the malformed input causes abnormal transport exception handling and connection closure. This affects Apache ActiveMQ versions before 5.19.8 and versions from 6.0.0 up to but not including 6.2.7. The issue is fixed in versions 5.19.8 and 6.2.7.

The vulnerability enables remote unauthenticated attackers to cause denial-of-service on Apache ActiveMQ servers exposing the STOMP connector. The impact includes potential out-of-memory conditions for NIO STOMP transport and forced connection closures for blocking STOMP transport. No information about code execution or data disclosure is provided.

Users should upgrade Apache ActiveMQ to version 5.19.8 or 6.2.7 or later, as these versions contain fixes for this vulnerability. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory recommending these fixed versions.