LoginSign Up
← Back to all sparks
A

Apache ActiveMQ

DEVOPS
Velocity5.0

Multi-protocol open-source message broker

activemq.apache.org ↗

ActiveMQ is shrinking its own defaults — servlets off, factories blocked, frames capped.

message brokersecure defaultsamqpmqttbackportshardening
◆Current state
ActiveMQ maintains three lines in parallel — 5.19.x, 6.2.x and the new 6.3.0 — and ships them within seconds of each other, with the same fixes carried across each branch. Almost every change is defensive: AMQP frame size validation with a 10 MB default cap, MQTT control packet and wireformat validation, Stomp transport validation, WireFormatInfo checks, and a steadily growing JMX denied list. One maintainer authors the overwhelming majority of it.
◆Where it's heading
The project is walking its defaults inward — disabling the message servlet, blocking XBeanBrokerFactory inside VMTransportFactory, restricting BrokerView URIs, capping frame sizes — so that a stock broker exposes far less than it did a year ago. That is a posture change, not a patch series: each release trades some deployment compatibility for a smaller attack surface, and operators upgrading will find things switched off that used to be on.
◆Prediction
Expect the remaining permissive defaults to keep falling one release at a time, and expect 6.3.0 to inherit the same hardening backports rather than diverge on features. The repo metadata dropping 'classic' mentions suggests the branding split with Artemis is being finalized, but the entries do not show what replaces it.

◆Recent moves

  1. 9d ago

    AMQP frame size capped at 10 MB by default

    The 5.19 line lowers the default maxFrameSize to 10 MB and adds real frame size validation for AMQP, plus a cursor guard preventing more than 100% temp store use. It continues the pattern of tightening a default that previously let a client dictate broker memory pressure.

    View source ↗
  2. 9d ago

    Same frame size and temp store limits on the 6.2 line

    The 6.2 branch receives the identical frame size cap, AMQP validation and temp store guard, released in the same minute as its 5.19 twin. The mirrored release is now the project's standard shape — no branch is left behind on a hardening fix.

    View source ↗
  3. 9d ago

    6.3.0 opens with MQTT packet validation

    The new minor line arrives carrying validation for MQTT control packets and wireformat rather than headline features, along with a queue size fix for non-persistent messages with a TTL. Repo metadata also drops its 'classic' references, tidying the split from Artemis.

    View source ↗
  4. 1mo ago

    Advisory topic defaults and Stomp transport validation

    Advisory messages move to the broker connection context and default configs for advisory topics are revised, while Stomp transports and WireFormatInfo gain validation. This is the middle of the hardening arc: protocol entry points being checked one transport at a time.

    View source ↗
  5. 1mo ago

    6.2 mirror of the advisory and Stomp hardening

    The 6.2 counterpart to the same set of transport validations and advisory context changes, again released seconds apart. Only the branch prefixes in the commit list distinguish the two.

    View source ↗
  6. 2mo ago

    Message servlet off, XBeanBrokerFactory blocked by default

    ⚡ SPARK

    This is the release where hardening stops being additive validation and starts removing capability from stock installs. Everything that follows — frame caps, advisory context changes, MQTT validation — extends the principle established here.

    View source ↗