Cyber ·
CVE-2026-108949: ActiveMQ can run out of memory from repeated requests to temporary destinations
Moderate-severity advisory for Apache ActiveMQ and ActiveMQ Broker: an authenticated OpenWire client can cause excessive memory use. Fixed versions: 6.3.3 and 5.19.12.
On November 3, 2026, Christopher L. Shannon published advisory CVE-2026-108949 on the oss-sec mailing list feed, rated moderate severity. The flaw affects Apache ActiveMQ from 6.0.0 before 6.3.3 and versions before 5.19.12, as well as ActiveMQ Broker in the same ranges. According to the description, it is a denial-of-service condition caused by memory exhaustion (OOM). An authenticated OpenWire client sends a ConsumerInfo to a temporary queue or topic belonging to another connection. The request is rejected with InvalidDestinationException, but the text available in the feed indicates that the broker keeps consuming memory with each repeated send. The text received is an automatic translation and is truncated, so the full technical details should be checked in the original source. For a reader who runs ActiveMQ, the practical point is to check whether the installation is on an affected version and plan an upgrade to 6.3.3 or 5.19.12, depending on the line in use. Rota Nacional does not operate this broker and does not fix the flaw. The platform protects personal data in prompts and model responses, but it does not replace patching internal messaging systems. To verify, read the original advisory on the oss-sec list site, confirm the installed version in your own environment, and check the official Apache ActiveMQ release page.