CVE-2026-108949

Overview

Apache ActiveMQ Classic is an open-source Java message broker that provides asynchronous messaging for applications. It supports JMS 1.1 and multiple wire protocols, including OpenWire, AMQP, MQTT and STOMP. Broker and client components are published as Maven artifacts under org.apache.activemq. ActiveMQ Classic is distinct from Apache ActiveMQ Artemis, which has its own broker implementation and release lines.

A denial of service vulnerability (CVE-2026-108949) has been identified in the Apache ActiveMQ Classic broker, which allows an authenticated client to exhaust the broker's heap by repeatedly asking to consume from a temporary queue or topic owned by another connection. Each rejected request leaves a subscription behind in broker memory, so the broker eventually fails with an OutOfMemoryError.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Apache ActiveMQ Classic.

Details

Module Info

• Product: Apache ActiveMQ Classic
• Affected packages: org.apache.activemq:activemq-broker
• Affected versions: <5.19.12, >=6.0.0 <6.3.3
• GitHub repository: https://github.com/apache/activemq
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/activemq-broker
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Classic 5.19.12, 6.3.3, 6.4.0
  • NES for ActiveMQ v5.16.12

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.activemq:activemq-broker package in multiple versions of Apache ActiveMQ Classic.

When a client sends a ConsumerInfo, the broker's AbstractRegion.addConsumer creates a Subscription, records it in the region's subscriptions map, and then adds it to every matching destination. Only a SecurityException from Destination.addSubscription triggers cleanup of the map entry and of any destinations the subscription was already added to:

// ensure sub visible to any new dest addSubscriptionsForDestination
subscriptions.put(info.getConsumerId(), sub);
...
for (Destination dest : addList) {
    try {
        dest.addSubscription(context, sub);
        removeList.add(dest);
    } catch (SecurityException e){
        ...
        subscriptions.remove(info.getConsumerId());
        removeList.clear();
        throw e;
    }
}

Temporary destinations reject consumers from other connections with a different exception. TempQueue.addSubscription (and TempTopic) throws InvalidDestinationException when the subscribing consumer's connection id is not the one that created the temporary destination:

if (!isAllowTempDestinationStealing() && !tempDest.getConnectionId().equals(connectionId)) {
    throw new InvalidDestinationException("Subscribing to a temporary queue created by another connection is not permitted");
}

That exception escapes addConsumer without passing through the cleanup branch, so the client is told the subscription failed, but the Subscription stays in the subscriptions map. An authenticated OpenWire client that knows the name of another connection's temporary queue or topic can repeat the request with new consumer ids, leaking one subscription per request until the broker runs out of heap.

Mitigation

Inactive versions of Apache ActiveMQ Classic are End-of-Life and will not receive updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Apache ActiveMQ Classic that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

Yicheng Yu (finder)