Skip to content
Fencer Intel
medium 6.5

CVE-2026-108949 json

Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM

published 5d ago modified 3d ago also EUVD-2026-116825

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker.

An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map.

This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12.

Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.

Patch / fix

  • Apache Software Foundation Apache ActiveMQ 5.19.12, 6.3.3
  • Apache Software Foundation ActiveMQ Broker 5.19.12, 6.3.3

Is CVE-2026-108949 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-108949 updated cvss 6.5

org.apache.activemq/activemq-broker: activemq-broker: Denial of Service via memory leak from rejected subscriptions

  • Red Hat Fuse 7 activemq-broker 5.11.0.redhat-630517
    affected: workaround, no fix planned “Upgrade to fixed versions (activemq-broker 6.4.0, 6.3.3, or 5.19.12); restrict broker authentication and monitor broker heap.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5d ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Apache Software Foundation Apache ActiveMQ
  • Apache Software Foundation ActiveMQ Broker

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.