ActiveMQ KahaDB Input Length >65535 Crash (v<6.3.3 / <5.19.12)
CVE-2026-111821 Published on November 4, 2026
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Weakness Type
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Products Associated with CVE-2026-111821
Want to know whenever a new CVE is published for Apache ActiveMQ? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache ActiveMQ:- Version 6.0.0 and below 6.3.3 is affected.
- Before 5.19.12 is affected.
- Version 6.0.0 and below 6.3.3 is affected.
- Before 5.19.12 is affected.