CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2019-0222
High (7.5). EPSS 12% chance of exploitation in the next 30 days. Fixed in org.apache.activemq:activemq-client 5.15.9.
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
Severity
- EPSS
- 12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:activemq
- debian:debian_linux
- netapp:e-series_santricity_web_services
- oracle:communications_diameter_signaling_router
- oracle:enterprise_manager_base_platform
- oracle:enterprise_repository
- oracle:goldengate_stream_analytics
- oracle:identity_manager_connector
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jpv3-g4cc-6vfx | Maven | org.apache.activemq:activemq-client | >=5.0.0 <5.15.9 | 5.15.9 |
References
- http://activemq.apache.org/security-advisories.data/CVE-2019-0222-announcement.txt
- http://www.openwall.com/lists/oss-security/2019/03/27/2
- http://www.securityfocus.com/bid/107622
- https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1%40%3Cdev.activemq.apache.org%3E
- https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc%40%3Ccommits.activemq.apache.org%3E