CVE-2026-108946: Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection

Reported by oss-security

Summary by Cyber Security News3 Nov 2026, 21:40 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/492

Posted by Christopher L. Shannon on Nov 03 Severity: important Affected versions: - Apache ActiveMQ 6.0.0 before 6.3.3 - Apache ActiveMQ before 5.19.12 - ActiveMQ Broker 6.0.0 before 6.3.3 - ActiveMQ Broker before 5.19.12 Description: Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Fixed Detectors, Moving Code: How Well Do Static Security Analyzers Hold Up over a Decade of C/C++ Evolution?

When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation

CVE-2026-90631: Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables

CVE-2026-111822: Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation

CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal

CVE-2026-108949: Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM