CVE-2026-108949
Received Received - Intake

Denial of Service via OOM in Apache ActiveMQ

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Apache Software Foundation

Description
Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-108949
EUVD
EUVD-2026-116825

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service vulnerability via Out-of-Memory (OOM) in Apache ActiveMQ and ActiveMQ Broker. An authenticated OpenWire client sends a ConsumerInfo request for a temporary queue or topic owned by another connection. The broker rejects the request but fails to clean up the rejected subscription, causing a memory leak. Repeated requests lead to OOM and broker crash.

Detection Guidance

Monitor ActiveMQ broker memory usage and logs for repeated InvalidDestinationException errors. Check for temporary queue/topic subscriptions left behind after rejections. Use ActiveMQ admin console or JMX to inspect active subscriptions and heap usage.

Impact Analysis

This vulnerability can cause your Apache ActiveMQ broker to crash due to memory exhaustion. If exploited repeatedly, it may lead to service unavailability, disrupting message processing and communication between systems relying on ActiveMQ.

Mitigation Strategies

Upgrade Apache ActiveMQ and ActiveMQ Broker to versions 6.4.0, 6.3.3, or 5.19.12 or later. Restrict OpenWire client access to authenticated users only. Monitor broker memory and restart if OOM occurs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108949. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...