CVE-2026-108949: Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM
Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker.
An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.4.0 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.3.3 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.19.12
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Affected deployments are Apache ActiveMQ Broker versions from 6.0.0 before 6.3.3 and versions before 5.19.12. The issue involves OpenWire clients and temporary queues or topics.
What access does an attacker need to trigger the memory leak?
An attacker needs to authenticate as an OpenWire client and send ConsumerInfo requests for a temporary queue or topic owned by a different connection. Repeating rejected requests leaves subscriptions in the broker's subscriptions map until heap exhaustion causes an OOM condition.
What is the recommended remediation?
Upgrade to Apache ActiveMQ version 6.4.0, 6.3.3, or 5.19.12. These versions fix the failure to clean up rejected subscriptions.