Is CVE-2026-108949 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108949 being exploited in the wild.

How severe is CVE-2026-108949?

Informational severity, published 4 November 2026.

Which products and versions are affected?

Apache ActiveMQ 6.0.0 before 6.3.3; 5.15.0 before 5.19.12.

Is there a fix for CVE-2026-108949?

Yes: fixed in ActiveMQ 6.4.0, 6.3.3, 5.19.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108949 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-108949?

Check whether you run Apache ActiveMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108949: Apache ActiveMQ memory leak in subscription handling

CVE-2026-108949 · Severity: info · Published 2026-11-04

Apache ActiveMQ is a messaging broker used by applications to queue and route messages reliably. An authenticated attacker can repeatedly send invalid subscription requests that cause the broker to leak memory until it runs out of heap space and crashes, disrupting message delivery for all users of that broker.

Technologies: Apache ActiveMQ. Vendors: Apache.

Quick answers

Is CVE-2026-108949 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108949 being exploited in the wild.
How severe is CVE-2026-108949?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Apache ActiveMQ 6.0.0 before 6.3.3; 5.15.0 before 5.19.12.
Is there a fix for CVE-2026-108949?: Yes: fixed in ActiveMQ 6.4.0, 6.3.3, 5.19.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108949 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-108949?: Check whether you run Apache ActiveMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ActiveMQ 6.4.0, 6.3.3, 5.19.12

Technical details

When an OpenWire client sends a ConsumerInfo request for a temporary queue or topic owned by another connection, the broker rejects it with InvalidDestinationException but fails to remove the subscription from the region's subscriptions map. Repeating this request causes subscriptions to accumulate and leak broker heap memory until an out-of-memory condition occurs. The vulnerability requires an authenticated OpenWire client connection.

Affected products

Apache ActiveMQ 6.0.0 before 6.3.3; 5.15.0 before 5.19.12

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.