This vulnerability (CVE-2026-59878) in Apache ActiveMQ AMQP involves improper input validation (CWE-20) where a remote unauthenticated peer can send a malicious frame size value to an exposed AMQP NIO connector. This causes the NIO threads to terminate, and if exploited repeatedly, can exhaust the NIO thread pool, resulting in denial of service to other clients. The affected versions are Apache ActiveMQ AMQP and Apache ActiveMQ before 5.19.9, and from 6.0.0 before 6.2.8. The issue is resolved in versions 5.19.9, 6.2.8, and 6.3.0. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability.

An unauthenticated remote attacker can cause denial of service by sending specially crafted frames to the AMQP NIO connector, causing NIO threads to die and potentially exhausting the thread pool. This disrupts service availability for legitimate users. There is no impact on confidentiality or integrity.

Users should upgrade Apache ActiveMQ AMQP and Apache ActiveMQ to versions 5.19.9, 6.2.8, or later (e.g., 6.3.0) where this vulnerability is fixed. Patch status is confirmed by the vendor advisory recommending these versions. No other mitigations or temporary fixes are indicated.