ActiveMQ CPP is a messaging library that can use multiple protocols to talk to a MOM (e.g. ActiveMQ).
Apache ActiveMQ CPP suffers from an uncontrolled memory allocation vulnerability in its OpenWire byte-array unmarshalling. The unmarshal routines read a 32-bit size from the wire and resize a buffer to that size with no upper bound, and the inbound path enforces no maximum frame size. A malicious or MitM broker can set this length to 0x7FFFFFFF in the WireFormatInfo it sends as its first frame (before the client authenticates), forcing a ~2 GiB allocation that throws std::bad_alloc, uncaught in the unmarshal path, and crashes the client. This results in a remote denial of service.