CVE-2026-108949

{
  "etk_id": "ETK-2026-3486",
  "cve_id": "CVE-2026-108949",
  "display_id": "CVE-2026-108949",
  "ghsa_id": "GHSA-5j2c-q47c-c6w5",
  "euvd_id": "EUVD-2026-116825",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated memory leak in Apache ActiveMQ Broker subscriptions",
  "summary": "Apache ActiveMQ Broker versions from 6.0.0 before 6.3.3 and before 5.19.12 can retain invalid subscription state and consume broker heap memory. An authenticated OpenWire client able to reference a temporary destination associated with another connection can repeatedly trigger the condition, potentially making the broker unavailable.",
  "mitigation": "Upgrade Apache ActiveMQ Broker to 6.3.3 or later on the 6.x line, or to 5.19.12 or later on the 5.19 line. Restrict OpenWire access to trusted authenticated clients until upgrades are complete.",
  "vendor": "Apache Software Foundation",
  "product": "Apache ActiveMQ",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.0.0, < 6.3.3",
        ">= 0, < 5.19.12"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.3.3",
        "5.19.12"
      ],
      "package_name": "org.apache.activemq:activemq-broker",
      "purl": null
    }
  ],
  "cwes": [
    401
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 44.532209183333336,
  "t0_at": "2026-11-04T10:09:31.906000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-04T10:09:31.906000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T10:09:31.906000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108949"
    }
  }
}