CVE-2019-0222
Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
- Record
CVE-2019-0222- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
- Record
CVE-2019-0222- Updated
- 2026-11-02
EUVDEUVD-2019-0423 No score
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
- Record
EUVD-2019-0423- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jpv3-g4cc-6vfx
Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
- Record
GHSA-jpv3-g4cc-6vfx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
- Record
CVE-2019-0222- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-0222
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
- Record
DEBIAN-CVE-2019-0222- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-jpv3-g4cc-6vfx
Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
- Record
GHSA-jpv3-g4cc-6vfx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-0222
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
- Record
UBUNTU-CVE-2019-0222- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-6685-1 No score
mqtt-client vulnerability
It was discovered that mqtt-client incorrectly handled memory while parsing malformed MQTT frames. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-6685-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.activemq:activemq-clientMaven |
5.0.0 up to 5.15.9 | 5.15.9 |
activemqDebian:12 |
before 5.15.9-1 | 5.15.9-1 |
activemqDebian:13 |
before 5.15.9-1 | 5.15.9-1 |
mqtt-clientDebian:12 |
before 1.16-1 | 1.16-1 |
mqtt-clientDebian:13 |
before 1.16-1 | 1.16-1 |
mqtt-clientDebian:14 |
before 1.16-1 | 1.16-1 |
mqtt-clientDebian:9 |
before 1.14-1+deb9u1, plus listed versions 1.14-1 |
1.14-1+deb9u1 |
activemqDebian:9 From an advisory covering 4 CVEs |
before 5.14.3-3+deb9u2, plus listed versions 5.14.3-35.14.3-3+deb9u1 |
5.14.3-3+deb9u2 |
org.apache.activemq:activemq-clientMaven |
5.0.0 up to 5.15.9, plus listed versions 5.10.05.10.15.10.25.11.05.11.1 Show 31 moreShow less5.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.14.05.14.15.14.25.14.35.14.45.14.55.15.05.15.15.15.25.15.35.15.45.15.55.15.65.15.75.15.85.8.05.9.05.9.1 |
5.15.9 |
mqtt-clientUbuntu:Pro:16.04:LTS |
before 1.10-1ubuntu0.1~esm1, plus listed versions 1.10-1 |
1.10-1ubuntu0.1~esm1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
activemqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-25.13.2+dfsg-2ubuntu0.1~esm1 |
None known |
activemqUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.14.5-35.15.2-25.15.3-25.15.8-2~18.045.15.8-2~18.04.1~esm1 |
None known |
mqtt-clientUbuntu:Pro:18.04:LTS |
before 1.14-1ubuntu0.18.04.1~esm1, plus listed versions 1.14-1 |
1.14-1ubuntu0.18.04.1~esm1 |
mqtt-clientUbuntu:20.04:LTS |
before 1.14-1+deb10u1build0.20.04.1, plus listed versions 1.14-1 |
1.14-1+deb10u1build0.20.04.1 |
activemqUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.15.10-15.15.11-15.15.11-1ubuntu0.1~esm1 |
None known |
activemqUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.16.1-15.16.1-1ubuntu0.1~esm15.16.1-1ubuntu0.1 |
None known |
activemqUbuntu:24.04:LTS |
All versions, plus listed versions 5.17.2+dfsg-25.17.6+dfsg-1 |
None known |
mqtt-clientUbuntu:24.04:LTS |
All versions, plus listed versions 1.16-1 |
None known |
activemqUbuntu:25.10 |
All versions, plus listed versions 5.17.6+dfsg-15.17.6+dfsg-2 |
None known |
mqtt-clientUbuntu:25.10 |
All versions, plus listed versions 1.16-1 |
None known |
activemqUbuntu:26.10 |
All versions, plus listed versions 5.17.6+dfsg-25.17.6+dfsg-2ubuntu1 |
None known |
mqtt-clientUbuntu:26.10 |
All versions, plus listed versions 1.16-1build1 |
None known |
activemqUbuntu:26.04:LTS |
All versions, plus listed versions 5.17.6+dfsg-2 |
None known |
mqtt-clientUbuntu:26.04:LTS |
All versions, plus listed versions 1.16-11.16-1build1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | shoucheng3/apache__activemq_CVE-2019-0222_5-15-8 | 2025-08-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-0222 is a high vulnerability (CVSS 7.5) in Apache Activemq, published March 28, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.0%, the 96th percentile. Fixed in org.apache.activemq:activemq-client 5.15.9.
References
lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc%40%3Ccommits.activemq.apache.org%3E
openwall.com/lists/oss-security/2019/03/27/2
Show 33 moreShow less
securityfocus.com/bid/107622
oracle.com/security-alerts/cpuapr2020.html
activemq.apache.org/security-advisories.data/CVE-2019-0222-announcement.txt
security.netapp.com/advisory/ntap-20190502-0006
lists.debian.org/debian-lts-announce/2021/03/msg00004.html
nvd.nist.gov/vuln/detail/CVE-2019-0222
github.com/apache/activemq/commit/98b9f2e
web.archive.org/web/20190404065432/http://www.securityfocus.com/bid/107622
security-tracker.debian.org/tracker/CVE-2019-0222
ubuntu.com/security/CVE-2019-0222
cve.org/CVERecord?id=CVE-2019-0222