CVE-2026-111821
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Exploit likelihood
What each source reports
CVE List No score
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
CVE-2026-111821- Weakness
- CWE-20
- Updated
- 2026-11-04
EUVDEUVD-2026-116826 No score
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
EUVD-2026-116826- Updated
- 2026-11-04
GitHub AdvisoriesGHSA-c86r-9hm3-5pcc No score
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can...
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
GHSA-c86r-9hm3-5pcc- Weakness
- CWE-20
- Updated
- 2026-11-04
NVD No score
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
CVE-2026-111821- Weakness
- CWE-20
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-111821 No score
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
DEBIAN-CVE-2026-111821- Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-111821 No score
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
UBUNTU-CVE-2026-111821- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activemqDebian:12 |
All versions, plus listed versions 5.17.2+dfsg-25.17.2+dfsg-2+deb12u15.17.6+dfsg-15.17.6+dfsg-2 |
None known |
activemqDebian:13 |
All versions, plus listed versions 5.17.6+dfsg-2 |
None known |
activemqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-25.13.2+dfsg-2ubuntu0.1~esm1 |
None known |
activemqUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.14.5-35.15.2-25.15.3-25.15.8-2~18.045.15.8-2~18.04.1~esm1 |
None known |
activemqUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.15.10-15.15.11-15.15.11-1ubuntu0.1~esm1 |
None known |
activemqUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.16.1-15.16.1-1ubuntu0.1~esm15.16.1-1ubuntu0.1 |
None known |
activemqUbuntu:24.04:LTS |
All versions, plus listed versions 5.17.2+dfsg-25.17.6+dfsg-1 |
None known |
activemqUbuntu:26.10 |
All versions, plus listed versions 5.17.6+dfsg-25.17.6+dfsg-2ubuntu1 |
None known |
activemqUbuntu:26.04:LTS |
All versions, plus listed versions 5.17.6+dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | NVD, OSV | |
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories | |
| cwes, references, title | CVE List, NVD | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-111821 is a vulnerability with no CVSS score yet in Apache Software Foundation Activemq, published November 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.
References
lists.apache.org/thread/p8gxq66lmztkrls74wkz3xh9chqd0pwl
openwall.com/lists/oss-security/2026/11/03/19
nvd.nist.gov/vuln/detail/CVE-2026-111821
github.com/advisories/GHSA-c86r-9hm3-5pcc
security-tracker.debian.org/tracker/CVE-2026-111821
ubuntu.com/security/CVE-2026-111821
cve.org/CVERecord?id=CVE-2026-111821