-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.activemq:activemq-core | maven | < 5.6.0 | 5.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of failed connections in the OpenWire protocol implementation. The patches show critical changes in connection disposal logic: (1) ActiveMQConnection.syncSendPacket now disposes transports on security exceptions, (2) TransportConnection.service uses delayedStop() to terminate lingering connections, and (3) processAddConnection includes cleanup for failed connections. These functions directly correlate with the described DoS vector (file descriptor exhaustion via repeated failed connections), as confirmed by the JIRA AMQ-3294 PoC and commit messages addressing connection lifecycle management.
JavaJava