Cyber ·
CVE-2026-111821: oversized client identifiers poison the Apache ActiveMQ KahaDB journal
Advisory rated important on improper input validation in Apache ActiveMQ and KahaDB: durable subscriptions whose combined field length exceeds 65,535 may affect the KahaDB journal. Affected versions and original source are listed in the text.
Advisory CVE-2026-111821 was published on the oss-sec feed on November 3, 2026 by Christopher L. Shannon and rated important. According to the text, input validation is improper: a user can create a durable subscription whose clientId and subscription name, combined, exceed 65,535 characters, even though each field is smaller than that limit on its own. The flaw may affect the KahaDB journal.
Affected versions listed: Apache ActiveMQ 6.0.0 before 6.3.3; Apache ActiveMQ before 5.19.12; Apache ActiveMQ KahaDB 6.0.0 before 6.3.3; and Apache ActiveMQ KahaDB before 5.19.12. The supplied text gives no CVSS score, proof of concept or exploitation details, and this summary does not add them. To verify, consult the original advisory cited in the source and the Apache project's official announcement.