CVE-2021-4040 org.apache.activemq:artemis-core-client Vulnerable to Out-of-Bounds Write

What is CVE-2021-4040?

CVE-2021-4040 is a medium-severity denial of service vulnerability in AMQ Broker, published on 24 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.

Weakness: CWE-787, CWE-400

Which versions are affected by CVE-2021-4040?

2 open source packages ship an affected version, including org.apache.activemq:artemis-core-client. It affects 2 products.

Products include Apache Artemis, Redhat Amq Broker.

How do I fix CVE-2021-4040?

Upgrade org.apache.activemq:artemis-core-client to 2.19.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-4040 being exploited?

There is no known exploitation of CVE-2021-4040 in the wild and no public exploit code.

Other vulnerabilities in AMQ Broker

• CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment Critical 9.8
• CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Critical 9.3
• CVE-2026-49364 Information disclosure in Apache ActiveMQ Artemis Critical 9.1
• CVE-2026-67593 Missing authorization in Apache ActiveMQ Artemis Critical 9.1
• CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gf8c-j759-86mg.