Uncontrolled Resource Consumption in Artemis and HornetQ

2022-05-1301:11:53

Google

osv.dev

0.009 Low

EPSS

Percentile

83.1%

JSON

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.

CPENameOperatorVersion
org.apache.activemq:artemis-nativeeq1.0.0
org.hornetq:hornetq-servereq2.3.4.Final
org.apache.activemq:artemis-nativeeq1.2.0
org.hornetq:hornetq-servereq2.3.7.Final
org.apache.activemq:artemis-nativeeq2.2.0
org.apache.activemq:artemis-nativeeq1.5.3
org.hornetq:hornetq-servereq2.4.0.Alpha1
org.hornetq:hornetq-servereq2.3.22.Final
org.apache.activemq:artemis-nativeeq1.3.0
org.hornetq:hornetq-servereq2.4.0.Beta2

Name	Operator	Version
org.apache.activemq:artemis-native	eq	1.0.0
org.hornetq:hornetq-server	eq	2.3.4.Final
org.apache.activemq:artemis-native	eq	1.2.0
org.hornetq:hornetq-server	eq	2.3.7.Final
org.apache.activemq:artemis-native	eq	2.2.0
org.apache.activemq:artemis-native	eq	1.5.3
org.hornetq:hornetq-server	eq	2.4.0.Alpha1
org.hornetq:hornetq-server	eq	2.3.22.Final
org.apache.activemq:artemis-native	eq	1.3.0
org.hornetq:hornetq-server	eq	2.4.0.Beta2