{"id":"CVE-2026-111821","title":"Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal","summary":"Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.\n\n\n\nA user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) o…","severity":"none","cwe":["CWE-20"],"vendor":"Apache Software Foundation","product":"org.apache.activemq:apache-activemq","affected":["org.apache.activemq:apache-activemq >= 6.0.0 < 6.3.3","org.apache.activemq:apache-activemq < 5.19.12","org.apache.activemq:activemq-kahadb-store >= 6.0.0 < 6.3.3","org.apache.activemq:activemq-kahadb-store < 5.19.12"],"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T10:10:41.422Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111821","references":[{"url":"https://lists.apache.org/thread/p8gxq66lmztkrls74wkz3xh9chqd0pwl"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T20:33:06.726Z","slug":"CVE-2026-111821","body":"## Overview\n\nImproper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.\n\n\n\nA user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. \n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.\n\n## Affected\n\n- `org.apache.activemq:apache-activemq >= 6.0.0 < 6.3.3`\n- `org.apache.activemq:apache-activemq < 5.19.12`\n- `org.apache.activemq:activemq-kahadb-store >= 6.0.0 < 6.3.3`\n- `org.apache.activemq:activemq-kahadb-store < 5.19.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}