As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-108949: Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM
CVE-2026-108949 affects Apache ActiveMQ and ActiveMQ Broker in versions before 5.19.12 and 6.3.3, allowing an authenticated OpenWire client to trigger an out of memory (OOM) condition by repeatedly sending ConsumerInfo requests for temporary queues or topics owned by other connections. The vulnerability is rated moderate severity and exploits improper resource cleanup when requests are rejected with InvalidDestinationException.
Why it matters: Organizations running ActiveMQ versions 5.x before 5.19.12 or 6.x before 6.3.3 should patch immediately, as authenticated attackers can crash brokers with repeated malformed consumer requests, disrupting message-dependent services.
- Source published
- First seen by Cybersecurity Tracker