Cyber ·
CVE-2026-108946: ActiveMQ does not verify that user-supplied connection IDs belong to the connection
Advisory from the oss-sec feed, published on November 3, 2026, about an input validation flaw in the Apache ActiveMQ and KahaDB broker. The severity is listed as important, and the text lists affected and fixed versions.
Advisory CVE-2026-108946 describes an input validation flaw in Apache ActiveMQ and Apache ActiveMQ KahaDB. According to the text, the broker resolves connection, session and consumer states from user-supplied IDs and, in some scenarios, does not adequately verify that those IDs are bound to the corresponding connection. The content was published by Christopher L. Shannon on the oss-sec feed on November 3, 2026, with severity classified as important.
The listed affected versions are Apache ActiveMQ 6.0.0 before 6.3.3 and Apache ActiveMQ before 5.19.12, with the same ranges for ActiveMQ Broker. The available text was truncated before the full description of the scenarios, so other impacts or mitigations beyond the cited versions cannot be detailed here. To consult the original, open the oss-sec feed at the source address given in the item and check the full text and the vendor recommendations.