---
id: "CVE-2026-108949"
kind: "vulnerability"
aliases: ["CVE-2026-108949"]
title: "Apache ActiveMQ: repeated temporary-destination requests exhaust broker memory"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["activemq", "java", "message-broker", "openwire", "package"]
not_affected_if: ["no-openwire-transport", "not-using-activemq", "versions-patched"]
published_at: "2026-11-04T10:17:24+00:00"
first_seen_at: "2026-11-04T10:26:33+00:00"
updated_at: "2026-11-04T10:27:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108949", "first_seen_at": "2026-11-04T10:26:33+00:00"}]
---

# Apache ActiveMQ: repeated temporary-destination requests exhaust broker memory

An authenticated OpenWire client can send ConsumerInfo requests for temporary destinations owned by other connections; each rejected request leaves a subscription behind in the broker. Repeating the request grows broker heap until the broker runs out of memory and stops.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ActiveMQ version in use, for example with `activemq --version` or the version in the broker's lib directory.
- Confirm whether the OpenWire transport is exposed to clients you do not fully trust.

## Fix

- Apache ActiveMQ 6.x: move to `6.3.3` or `6.4.0`.
- Apache ActiveMQ 5.x: move to `5.19.12`.
- ActiveMQ Broker: same versions as above.

## Timeline

- 2026-11-04T10:26:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108949

## From the sources

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker.



An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map.



This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12.



Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_