{"id":"CVE-2026-111821","kind":"vulnerability","aliases":["CVE-2026-111821"],"related":[],"title":"Apache ActiveMQ: long durable subscription names crash KahaDB broker permanently","description":"Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.\n\n\n\nA user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. \n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.","summary":"A client can create a durable subscription whose combined clientId and subscription name exceed 65,535 characters, which breaks the broker's KahaDB storage. The broker then shuts down and cannot recover without intervention.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["activemq","java","kahadb","messaging","package"],"not_affected_if":["no-durable-subscriptions","non-kahadb-persistence"],"how_to_check":"- Check the ActiveMQ version in the broker install, for example `activemq --version` or the version in the distribution's lib folder.\n- Confirm whether the broker uses KahaDB as its persistence adapter in `activemq.xml`.","fix":"- Apache ActiveMQ 6.x: move to `6.3.3` or later (`6.4.0` recommended by the source).\n- Apache ActiveMQ 5.x: move to `5.19.12` or later.\n- Apache ActiveMQ KahaDB: same fixed versions as above.","status":"open","published_at":"2026-11-04T10:17:25+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","triaged_at":"2026-11-04T10:27:20+00:00","updated_at":"2026-11-04T10:27:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T10:27:20Z","model":"claude-haiku-5-5","output":{"fix":"- Apache ActiveMQ 6.x: move to `6.3.3` or later (`6.4.0` recommended by the source).\n- Apache ActiveMQ 5.x: move to `5.19.12` or later.\n- Apache ActiveMQ KahaDB: same fixed versions as above.","reach":"network","title":"Apache ActiveMQ: long durable subscription names crash KahaDB broker permanently","impact":"medium","summary":"A client can create a durable subscription whose combined clientId and subscription name exceed 65,535 characters, which breaks the broker's KahaDB storage. The broker then shuts down and cannot recover without intervention.","audience":"businesses","category":"package","nicknames":[],"who_cares":["activemq","messaging","java","kahadb"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"broker crashes and cannot recover from its KahaDB store","analyst_note":"","how_to_check":"- Check the ActiveMQ version in the broker install, for example `activemq --version` or the version in the distribution's lib folder.\n- Confirm whether the broker uses KahaDB as its persistence adapter in `activemq.xml`.","plain_action":"","needs_analyst":false,"not_affected_if":["non-kahadb-persistence","no-durable-subscriptions"],"who_is_affected":"Only brokers that use KahaDB persistence and accept durable subscriptions from clients are exposed; the affected range is 6.0.0 before 6.3.3 and before 5.19.12. Brokers on other persistence adapters are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4256,"output_tokens":597,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111821':13A,16A '-2026':12A,15A '5.19.12':115C,124C,135C '535':37B,85C '6.0.0':111C,120C '6.3.3':113C,122C,133C '6.4.0':132C '65':36B,84C 'activemq':2A,17B,62C,64C,109C,117C 'affect':107C 'apach':1A,61C,63C,108C,116C 'break':40B 'broker':9A,42B,47B,92C,99C 'cannot':52B 'caus':97C 'charact':38B 'client':23B 'clientid':31B,75C 'combin':30B,82C 'crash':7A 'creat':25B,69C 'cve':11A,14A 'durabl':4A,27B,71C 'exceed':35B 'fix':137C 'improp':56C 'input':57C 'intervent':55B 'issu':106C,139C 'java':18B 'kahadb':8A,19B,44B,65C,94C,118C 'length':83C 'long':3A 'messag':20B 'name':6A,34B,78C 'packag':21B 'perman':10A 'recommend':127C 'recov':53B 'separ':87C 'shorter':89C 'shut':49B 'shutdown':101C 'storag':45B 'subscript':5A,28B,33B,72C,77C 'unrecover':104C 'upgrad':129C 'use':93C 'user':67C,125C 'valid':58C 'version':131C 'vulner':59C 'whose':29B 'without':54B","nicknames":[],"mitigations":[],"who_affected":"Only brokers that use KahaDB persistence and accept durable subscriptions from clients are exposed; the affected range is 6.0.0 before 6.3.3 and before 5.19.12. Brokers on other persistence adapters are not described as affected by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activemq","high","java","kahadb","messaging","package"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111821","severity":null,"published_at":"2026-11-04T10:17:25+00:00","modified_at":"2026-11-04T10:17:25+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","fetched_at":"2026-11-04T10:26:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}