UBUNTU-CVE-2026-108949: Medium severity ubuntu/activemq vulnerability

Published Nov 4, 2026

Updated

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.

Affected Software

7 affected components

ubuntu/activemq*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 6.4.0
Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 6.3.3
Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 5.19.12

Event History

Nov 4, 2026

CVE Published

via OSV·10:17 AM

Data Sourced

via OSV·10:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

The attacker must be an authenticated OpenWire client. They need to send ConsumerInfo requests for a temporary queue or topic owned by another connection.

Which deployments are affected?

Apache ActiveMQ and ActiveMQ Broker versions from 6.0.0 before 6.3.3, and versions before 5.19.12, are affected. The issue is in broker handling of rejected subscriptions.

What happens when the attack is repeated?

Each rejected request leaves a Subscription in the region subscriptions map despite returning InvalidDestinationException. Repeated requests leak broker heap memory until the broker reaches an out-of-memory condition.

What version should be deployed to remediate the issue?

Upgrade to Apache ActiveMQ version 6.4.0, 6.3.3, or 5.19.12. These versions contain the fix.

UBUNTU-CVE-2026-108949: Medium severity ubuntu/activemq vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

Which deployments are affected?

What happens when the attack is repeated?

What version should be deployed to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

Which deployments are affected?

What happens when the attack is repeated?

What version should be deployed to remediate the issue?