CVE-2026-108949 · Package
NO FIX YET · SEE WHAT TO DO
An authenticated OpenWire client can send ConsumerInfo requests for temporary destinations owned by other connections; each rejected request leaves a subscription behind in the broker. Repeating the request grows broker heap until the broker runs out of memory and stops.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Brokers from 6.0.0 before 6.3.3 and 5.x before 5.19.12 are affected when OpenWire clients can authenticate to them. Brokers that accept only trusted, authenticated clients have a smaller exposure, but the broker still leaks memory under repeated requests from any authenticated client. Teams that do not run ActiveMQ can skip this.
Not affected if no-openwire-transport, not-using-activemq, versions-patched
Who cares activemq, java, message-broker, openwire
activemq --version or the version in the broker's lib directory.6.3.3 or 6.4.0.5.19.12.Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker.
An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-108949")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.