CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQ KahaDBto a version that resolves this vulnerability.Fixed in 6.4.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Brokers using KahaDB are affected if they run ActiveMQ 6.0.0 through versions before 6.3.3, or an affected 5.x release before 5.19.12. The issue is also identified for Apache ActiveMQ KahaDB in those same version ranges.
What does an attacker need to do to trigger the failure?
The attacker must be able to create a durable subscription. They can supply a clientId and subscription name whose combined length exceeds 65,535, while each individual value remains shorter than that limit.
What is the operational impact?
The oversized combined identifier can poison the KahaDB journal, causing the broker to shut down and become unrecoverable.
What versions address the vulnerability?
Upgrade to ActiveMQ 6.4.0, 6.3.3, or 5.19.12. These versions fix the issue.