Cyber ·
CVE-2026-103582: DoS from unbounded length fields in the Apache NMS ActiveMQ client
Low-severity advisory on excessive memory allocation in the .NET OpenWire client of Apache NMS ActiveMQ, fixed in version 2.3.0.
According to the text received, advisory CVE-2026-103582 was published on November 3, 2026 by Christopher L. Shannon on the oss-sec list, with severity classified as low. The issue is in the .NET OpenWire client of the Apache NMS ActiveMQ library (package Apache.NMS.ActiveMQ). The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network, without enforcing a maximum frame size, which allows excessive memory allocation and denial of service.
The affected versions are the client library up to 2.2.0, and the fix is in 2.3.0. The text received is truncated, so exploitation conditions and other details are not included here. To verify, consult the original advisory in the oss-sec list archive using the CVE identifier and check the package version in your projects. This is an engineering problem in a third-party library; Rota Nacional does not solve it and does not offer a fix for it.