CVE-2026-108949
Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated…
- Risk score
- 47/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. R…
- Affected
- See advisory
- Fix
- Upgrade the product to 6.3.3, 5.19.12 or 6.4.0 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.
Last activity 4 Nov 2026. Patch Forecast updates every hour.