Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-108949

Denial of Service via OOM in Apache ActiveMQ and ActiveMQ Broker

CVSS 3.1
6.5 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-108949 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Apache ActiveMQ and ActiveMQ Broker have a DoS vulnerability where an authenticated OpenWire client can trigger repeated rejected ConsumerInfo requests for temporary queues/topics owned by other connections. This leaves rejected subscriptions in the region map without cleanup, exhausting broker heap memory until OOM. Affected are versions from 6.0.0 before 6.3.3 and before 5.19.12.

What to do: Upgrade Apache ActiveMQ/ActiveMQ Broker to 6.4.0, 6.3.3 or 5.19.12. No workaround stated.

ProductAffectedFixed in
Apache ActiveMQfrom 6.0.0 before 6.3.3, before 5.19.126.4.0, 6.3.3, 5.19.12
Apache ActiveMQ Brokerfrom 6.0.0 before 6.3.3, before 5.19.126.4.0, 6.3.3, 5.19.12
Estimated exposure
nicheNo basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.

Weakness
CWE-401
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story