CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal

As cited

Copy frozen at 2026-11-03 23:53 UTC (site build).

vulnerabilities

CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal

CVE-2026-111821 is an improper input validation vulnerability in Apache ActiveMQ and Apache ActiveMQ KahaDB that allows an attacker to create a durable subscription with a clientId and subscription name whose combined length exceeds 65,535 characters, poisoning the KahaDB journal. The flaw affects ActiveMQ versions before 5.19.12 and 6.3.3, and KahaDB versions before 5.19.12 and 6.3.3. The vulnerability carries important severity.

Why it matters: Organizations running affected versions of Apache ActiveMQ or KahaDB must upgrade immediately to prevent journal corruption that could disrupt message broker operations and data persistence.

Source published

2026-11-03 20:43 UTC

First seen by Cybersecurity Tracker

2026-11-03 23:00 UTC