CVE-2026-111821
Description
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
How to fix
- Apache ActiveMQ6.3.3, 5.19.12 or later
- Apache ActiveMQ KahaDB6.3.3, 5.19.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache ActiveMQ | 6.0.0 ≤ v, No range specified | 6.3.3, 5.19.12 |
| Apache ActiveMQ KahaDB | 6.0.0 ≤ v, No range specified | 6.3.3, 5.19.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.