https://seclists.org/oss-sec/2026/q4/493: CVE-2026-108949: Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM

Q: What access does an attacker need to trigger the denial of service?

The attacker must be an authenticated OpenWire client. They must be able to send ConsumerInfo requests targeting a temporary queue or topic owned by a different connection.

Q: What happens when the malicious requests are repeated?

Each rejected request leaves a Subscription object in the broker region's subscriptions map despite returning InvalidDestinationException. Repeating the requests consumes broker heap until the process runs out of memory.

Q: Which versions should be used to remediate the issue?

Upgrade to Apache ActiveMQ or ActiveMQ Broker 6.4.0, 6.3.3, or 5.19.12. The affected ranges are 6.0.0 through versions before 6.3.3, and releases before 5.19.12.

Published Nov 3, 2026

Updated

Affected Software

2 affected components

Apache ActiveMQ>=6.0.0<6.3.3, <5.19.12

Apache ActiveMQ Broker>=6.0.0<6.3.3, <5.19.12

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

The attacker must be an authenticated OpenWire client. They must be able to send ConsumerInfo requests targeting a temporary queue or topic owned by a different connection.

What happens when the malicious requests are repeated?

Each rejected request leaves a Subscription object in the broker region's subscriptions map despite returning InvalidDestinationException. Repeating the requests consumes broker heap until the process runs out of memory.

Which versions should be used to remediate the issue?

Upgrade to Apache ActiveMQ or ActiveMQ Broker 6.4.0, 6.3.3, or 5.19.12. The affected ranges are 6.0.0 through versions before 6.3.3, and releases before 5.19.12.

https://seclists.org/oss-sec/2026/q4/493: CVE-2026-108949: Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM

Affected Software

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

What happens when the malicious requests are repeated?

Which versions should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

What happens when the malicious requests are repeated?

Which versions should be used to remediate the issue?