---
id: CVE-2026-111821
title: >-
  Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings
  poison the KahaDB journal
summary: >-
  Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ
  KahaDB.




  A user can create a durable subscription with a clientId and subscription name
  that have a combined length > 65,535 (while separately being shorter) o…
severity: none
cwe:
  - CWE-20
vendor: Apache Software Foundation
product: 'org.apache.activemq:apache-activemq'
affected:
  - 'org.apache.activemq:apache-activemq >= 6.0.0 < 6.3.3'
  - 'org.apache.activemq:apache-activemq < 5.19.12'
  - 'org.apache.activemq:activemq-kahadb-store >= 6.0.0 < 6.3.3'
  - 'org.apache.activemq:activemq-kahadb-store < 5.19.12'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T10:10:41.422Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111821'
references:
  - url: 'https://lists.apache.org/thread/p8gxq66lmztkrls74wkz3xh9chqd0pwl'
tags:
  - cve.org
ingestedAt: '2026-11-05T20:33:06.726Z'
---

## Overview

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.



A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. 



This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.



Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

## Affected

- `org.apache.activemq:apache-activemq >= 6.0.0 < 6.3.3`
- `org.apache.activemq:apache-activemq < 5.19.12`
- `org.apache.activemq:activemq-kahadb-store >= 6.0.0 < 6.3.3`
- `org.apache.activemq:activemq-kahadb-store < 5.19.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.