Threats tagged 'ghsa-cvrj-57gg-c399'

Apache NMS ActiveMQ versions before 2.3.0 have a vulnerability in the OpenWire unmarshalling code where frame size and length fields from the network are not properly validated. This allows a malicious or compromised broker, or an attacker intercepting an unencrypted connection, to send crafted frames with oversized or negative lengths. This can cause excessive memory allocation, leading to OutOfMemoryException or uncaught exceptions, resulting in denial of service of the client application. Version 2.3.0 introduces a configurable maximum frame size and proper length validation to mitigate this issue.