Apache ActiveMQ CVE-2026-108949

Exploitation requires an authenticated OpenWire-protocol client connection to the broker (the description explicitly states an 'authenticated OpenWire client'), so the attacker must already hold valid broker credentials or control a legitimate client - this is the primary limiting factor. The specific trigger is sending a ConsumerInfo for a temporary queue or topic owned by a DIFFERENT connection, which the broker rejects with InvalidDestinationException while leaking the rejected Subscription; the attack requires repeating this request many times to accumulate enough leaked subscriptions to exhaust heap. It therefore most realistically affects brokers that expose OpenWire to semi-trusted, multi-tenant, or many credentialed clients. Exploitation is limited to affected versions (6.0.0 before 6.3.3, and anything before 5.19.12) and is neutralized by upgrading. Note: because no CVSS vector is provided, the authenticated requirement here is taken from the vendor description text rather than a confirmed PR metric.

This is a moderate-severity availability-only issue, and the signals that would normally drive prioritization are largely absent: the input provides no CVSS score or vector (N/A), no EPSS exploitation probability, no CISA KEV listing, and no SSVC technical-impact decision beyond a vuln.today priority of 'awaiting_data'. No public exploit or PoC reference is present in the input. Based on the description, exploitation requires an authenticated OpenWire client, which meaningfully raises the bar versus an unauthenticated network flaw - a hostile or compromised credentialed client (or a malicious tenant in a shared broker) can repeatedly send ConsumerInfo requests for temporary destinations owned by other connections, leaking rejected Subscription objects in the region's subscriptions map until the broker heap is exhausted and the JVM hits OutOfMemory. The real-world impact is a crash/denial of service of the message broker, with no confidentiality or integrity consequence. Treat this as a patch-in-normal-cycle availability hardening issue rather than an emergency: the moderate vendor rating, authenticated precondition, and DoS-only impact all point to limited blast radius, but because ActiveMQ brokers are often central infrastructure, environments that expose OpenWire to semi-trusted or multi-tenant clients should prioritize the upgrade. Note that the absence of a CVSS vector means the attack vector and privilege level below are inferred from the description, not confirmed by NVD.

An authenticated OpenWire client with valid broker credentials repeatedly sends ConsumerInfo frames referencing a temporary queue or topic owned by a different connection. Each request is correctly rejected with InvalidDestinationException, but the broker fails to remove the rejected Subscription from its subscriptions map, so memory grows with every repetition until the broker exhausts its heap and crashes. No public exploit or PoC reference is identified in the available data; the attack needs only a valid client connection and a scripted loop of malformed subscription requests.