Denial of Service Vulnerability in Apache ActiveMQ by Apache

CVE-2026-108949

What is CVE-2026-108949?

This vulnerability in Apache ActiveMQ arises from an Out Of Memory (OOM) issue triggered by an authenticated OpenWire client. When a client sends a ConsumerInfo for a temporary queue or topic owned by another connection, it is rejected and raises an InvalidDestinationException. However, the rejected subscription remains in the region's subscriptions map. Repeated requests cause a memory leak as the broker fails to clean up these rejected subscriptions, ultimately resulting in OOM conditions. To mitigate this issue, users should upgrade to versions 6.4.0, 6.3.3, or 5.19.12.

References