{"id":"CVE-2026-108949","kind":"vulnerability","aliases":["CVE-2026-108949"],"related":[],"title":"Apache ActiveMQ: repeated temporary-destination requests exhaust broker memory","description":"Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker.\n\n\n\nAn authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.","summary":"An authenticated OpenWire client can send ConsumerInfo requests for temporary destinations owned by other connections; each rejected request leaves a subscription behind in the broker. Repeating the request grows broker heap until the broker runs out of memory and stops.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["activemq","java","message-broker","openwire","package"],"not_affected_if":["no-openwire-transport","not-using-activemq","versions-patched"],"how_to_check":"- Check the ActiveMQ version in use, for example with `activemq --version` or the version in the broker's lib directory.\n- Confirm whether the OpenWire transport is exposed to clients you do not fully trust.","fix":"- Apache ActiveMQ 6.x: move to `6.3.3` or `6.4.0`.\n- Apache ActiveMQ 5.x: move to `5.19.12`.\n- ActiveMQ Broker: same versions as above.","status":"open","published_at":"2026-11-04T10:17:24+00:00","first_seen_at":"2026-11-04T10:26:33+00:00","triaged_at":"2026-11-04T10:27:23+00:00","updated_at":"2026-11-04T10:27:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T10:27:23Z","model":"claude-haiku-5-5","output":{"fix":"- Apache ActiveMQ 6.x: move to `6.3.3` or `6.4.0`.\n- Apache ActiveMQ 5.x: move to `5.19.12`.\n- ActiveMQ Broker: same versions as above.","reach":"network","title":"Apache ActiveMQ: repeated temporary-destination requests exhaust broker memory","impact":"low","summary":"An authenticated OpenWire client can send ConsumerInfo requests for temporary destinations owned by other connections; each rejected request leaves a subscription behind in the broker. Repeating the request grows broker heap until the broker runs out of memory and stops.","audience":"businesses","category":"package","nicknames":[],"who_cares":["activemq","openwire","java","message-broker"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"broker memory is exhausted, causing denial of service","analyst_note":"","how_to_check":"- Check the ActiveMQ version in use, for example with `activemq --version` or the version in the broker's lib directory.\n- Confirm whether the OpenWire transport is exposed to clients you do not fully trust.","plain_action":"","needs_analyst":false,"not_affected_if":["not-using-activemq","no-openwire-transport","versions-patched"],"who_is_affected":"Brokers from 6.0.0 before 6.3.3 and 5.x before 5.19.12 are affected when OpenWire clients can authenticate to them. Brokers that accept only trusted, authenticated clients have a smaller exposure, but the broker still leaks memory under repeated requests from any authenticated client. Teams that do not run ActiveMQ can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4293,"output_tokens":619,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108949':13A,16A '-2026':12A,15A '5.19.12':139C,147C,158C '6.0.0':135C,143C '6.3.3':137C,145C,156C '6.4.0':155C 'activemq':2A,17B,72C,73C,133C,140C 'affect':131C 'anoth':89C 'apach':1A,71C,132C 'authent':25B,76C 'behind':45B,101C 'broker':9A,21B,48B,53B,57B,74C,112C,118C,141C 'clean':121C 'client':27B,78C 'connect':38B,90C 'consumerinfo':30B,82C 'cve':11A,14A 'denial':64C 'destin':6A,34B 'exhaust':8A 'fix':160C 'grow':52B 'heap':54B,113C 'invaliddestinationexcept':94C 'issu':130C,162C 'java':18B 'leak':111C 'leav':42B 'left':100C 'map':107C,128C 'memori':10A,61B 'messag':20B 'message-brok':19B 'oom':68C,115C 'openwir':22B,26B,77C 'own':35B,87C 'packag':23B 'queue/topic':86C 'recommend':150C 'region':104C 'reject':40B,92C,97C,124C 'repeat':3A,49B,108C 'request':7A,31B,41B,51B,110C 'run':58B 'send':29B,80C 'servic':66C 'stop':63B 'subscript':44B,98C,106C,125C 'temporari':5A,33B,85C 'temporary-destin':4A 'upgrad':152C 'user':148C 'version':154C 'via':67C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Brokers from 6.0.0 before 6.3.3 and 5.x before 5.19.12 are affected when OpenWire clients can authenticate to them. Brokers that accept only trusted, authenticated clients have a smaller exposure, but the broker still leaks memory under repeated requests from any authenticated client. Teams that do not run ActiveMQ can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activemq","high","java","messagebroker","openwire","package"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108949","severity":null,"published_at":"2026-11-04T10:17:24+00:00","modified_at":"2026-11-04T10:17:24+00:00","first_seen_at":"2026-11-04T10:26:33+00:00","fetched_at":"2026-11-04T10:26:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}