CVE-2026-108949
Last modified
CVE-2026-108949 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue..
Description
Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | >= 6.0.0, < 6.3.3; < 5.19.12 |
| Apache Software Foundation | ActiveMQ Broker | >= 6.0.0, < 6.3.3; < 5.19.12 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-108949?
How severe is CVE-2026-108949?
How do I fix CVE-2026-108949?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-108943A weakness has been identified in ModelTC LightX2V up to 0.5…5.3
- CVE-2026-108944A security vulnerability has been detected in repository RAE…4.8
- CVE-2026-108945A vulnerability was detected in iMoonLab yolov13 up to 73289…5.3
- CVE-2026-108946Improper input validation vulnerability in Apache ActiveMQ, …
- CVE-2026-108947A flaw has been found in yoshitomo-matsubara torchdistill up…5.3
- CVE-2026-108948A vulnerability has been found in code-projects Online Revie…5.4
- CVE-2026-10895Use after free in Ozone in Google Chrome prior to 149.0.7827…8.8
- CVE-2026-108950Open Source Social Network (OSSN) through 10.1 contains a mi…5.3
- CVE-2026-108951LavaLite CMS through 10.1.2 contains an authorization bypass…6.5
- CVE-2026-108952RT-Thread through 5.3.0 contains a memory corruption vulnera…4.6
- CVE-2026-108953mac-shell-mcp before 2.0.0 contains an OS command injection …7.8
- CVE-2026-108954A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8…6.3
Are you affected by CVE-2026-108949?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST