CVE-2026-108949: Apache ActiveMQ broker vulnerable to repeated temporary destination requests (CVE-2026-108949)
Original title: CVE-2026-108949: Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM
Repeated rejected ConsumerInfo requests for temporary destinations can lead to broker OOM in versions before 6.3.3 and 5.19.12.
Apache ActiveMQ and ActiveMQ Broker have a denial of service vulnerability. An authenticated OpenWire client can send ConsumerInfo for a temporary queue or topic owned by another connection. The broker rejects it with InvalidDestinationException but repeated requests can exhaust resources leading to OOM.
Unconfirmed: No exploitation in the wild or fixed versions stated
- Denial of service via OOM
- Affects authenticated OpenWire clients
- Versions before 6.3.3 and 5.19.12
Impact: Denial of service through broker OOM
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108949 | Denial of Service via OOM in Apache ActiveMQ and ActiveMQ Broker | 6.5 | — |
From the original article
Posted by Christopher L. Shannon on Nov 03 Severity: moderate Affected versions: - Apache ActiveMQ 6. 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.