CVE-2021-4040

Vulnerability

CVE-2021-4040 is a denial-of-service (DoS) vulnerability in Red Hat AMQ Broker and the underlying Apache ActiveMQ Artemis project. The flaw resides in how the broker parses XID (transaction identifier) data during XA transactions, as detailed in the upstream fix [2]. By sending a sustained stream of maliciously crafted messages, an attacker can trigger an out-of-memory (OOM) condition on the broker, leading to partial interruption of service availability [1][3].

Exploitation

The attack is performed over the network without requiring authentication, as the broker's message parsing logic is exposed to external clients. The attacker must craft messages that exploit the XID parser, causing excessive memory allocation. No special privileges are needed; the attack can be sustained to keep the broker in an OOM state [1][3].

Impact

Successful exploitation leads to partial availability loss, meaning the broker may stop processing messages or become unresponsive for legitimate traffic. The vulnerability does not affect data confidentiality or integrity; the highest threat is system availability [1][3].

Mitigation

The vulnerability is addressed in the upstream Apache ActiveMQ Artemis project via commit 153d2e9a979aead8dff95fbc91d659ecc7d0fb82 [2]. Users should update to a patched version of AMQ Broker or ActiveMQ Artemis. Red Hat has released advisories and updated packages [1]. No workarounds are documented.