High
Security advisory
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-0222
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:31 UTC · Revision 1
Source evidence
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
osv:CVE-2019-0222
Complete source record
{
"id": "b61a768fca9291bb179f72c6dd2b5b29cf1f35f81753fd61f33b9c8780825b7e",
"url": "https://osv.dev/vulnerability/CVE-2019-0222",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-0222",
"summary": "In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.",
"evidence": "osv:CVE-2019-0222",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-0222",
"aliases": [
"CVE-2019-0222",
"GHSA-jpv3-g4cc-6vfx"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/activemq",
"type": "GIT",
"events": [
{
"introduced": "38fcc0ce0178d4a6870aa4f68e2b565c1ad0aa6f"
},
{
"last_affected": "bcad7e1f6a6dd078d87787a03b56560e995ef773"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.15.8"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-0222.json"
}
}
],
"modified": "2026-10-24T10:30:54.364570005Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1%40%3Cdev.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc%40%3Ccommits.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/71640324661c1b6d0b6708bd4fb20170e1b979370a4b8cddc4f8d485%40%3Cdev.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/7da9636557118178b1690ba0af49c8a7b7b97d925218b5774622f488%40%3Cusers.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/d1e334bd71d6e68462c62c726fe6db565c7a6283302f9c1feed087fa%40%3Ccommits.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b%40%3Cdev.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/rb698ed085f79e56146ca24ab359c9ef95846618675ea1ef402e04a6d%40%3Ccommits.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/re4672802b0e5ed67c08c9e77057d52138e062f77cc09581b723cf95a%40%3Ccommits.activemq.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2021/03/msg00004.html",
"https://lists.debian.org/debian-lts-announce/2021/03/msg00005.html",
"https://security.netapp.com/advisory/ntap-20190502-0006/",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:goldengate_stream_analytics",
"extracted_events": [
{
"range": [
{
"fixed": "19.1.0.0.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_diameter_signaling_router",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.0"
},
{
"introduced": "8.1"
},
{
"last_affected": "8.1"
},
{
"introduced": "8.2"
},
{
"last_affected": "8.2"
},
{
"introduced": "8.2.1"
},
{
"last_affected": "8.2.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:enterprise_manager_base_platform",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0.5.0"
},
{
"last_affected": "12.1.0.5.0"
},
{
"introduced": "13.2.0.0.0"
},
{
"last_affected": "13.2.0.0.0"
},
{
"introduced": "13.3.0.0.0"
},
{
"last_affected": "13.3.0.0.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:enterprise_repository",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.3.0.0"
},
{
"last_affected": "12.1.3.0.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:identity_manager_connector:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:identity_manager_connector",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-0222",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 438148,
"published_at": "2019-03-28T22:29:00.433+00:00"
}