https://seclists.org/oss-sec/2026/q4/494: CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal

Q: Which deployments are exposed to this issue?

Deployments using KahaDB are affected if they run Apache ActiveMQ 6.0.0 through versions before 6.3.3, or an Apache ActiveMQ release before 5.19.12. The same version ranges apply to Apache ActiveMQ KahaDB.

Q: What does an attacker need to do to trigger the failure?

The attacker needs to create a durable subscription with a clientId and subscription name whose combined length exceeds 65,535, while each individual value remains shorter than that limit. This can poison the KahaDB journal, shut down the broker, and leave it unrecoverable.

Q: What versions address the issue?

Upgrade to Apache ActiveMQ or Apache ActiveMQ KahaDB version 6.4.0, 6.3.3, or 5.19.12. These versions fix the improper input validation issue.

Published Nov 3, 2026

Updated

Affected Software

2 affected components

Apache ActiveMQ>=6.0.0<6.3.3, <5.19.12

Apache ActiveMQ KahaDB>=6.0.0<6.3.3, <5.19.12

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using KahaDB are affected if they run Apache ActiveMQ 6.0.0 through versions before 6.3.3, or an Apache ActiveMQ release before 5.19.12. The same version ranges apply to Apache ActiveMQ KahaDB.

What does an attacker need to do to trigger the failure?

The attacker needs to create a durable subscription with a clientId and subscription name whose combined length exceeds 65,535, while each individual value remains shorter than that limit. This can poison the KahaDB journal, shut down the broker, and leave it unrecoverable.

What versions address the issue?

Upgrade to Apache ActiveMQ or Apache ActiveMQ KahaDB version 6.4.0, 6.3.3, or 5.19.12. These versions fix the improper input validation issue.

https://seclists.org/oss-sec/2026/q4/494: CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal

Affected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the failure?

What versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the failure?

What versions address the issue?