---
id: "CVE-2026-111821"
kind: "vulnerability"
aliases: ["CVE-2026-111821"]
title: "Apache ActiveMQ: long durable subscription names crash KahaDB broker permanently"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["activemq", "java", "kahadb", "messaging", "package"]
not_affected_if: ["no-durable-subscriptions", "non-kahadb-persistence"]
published_at: "2026-11-04T10:17:25+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:27:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111821", "first_seen_at": "2026-11-04T10:26:34+00:00"}]
---

# Apache ActiveMQ: long durable subscription names crash KahaDB broker permanently

A client can create a durable subscription whose combined clientId and subscription name exceed 65,535 characters, which breaks the broker's KahaDB storage. The broker then shuts down and cannot recover without intervention.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ActiveMQ version in the broker install, for example `activemq --version` or the version in the distribution's lib folder.
- Confirm whether the broker uses KahaDB as its persistence adapter in `activemq.xml`.

## Fix

- Apache ActiveMQ 6.x: move to `6.3.3` or later (`6.4.0` recommended by the source).
- Apache ActiveMQ 5.x: move to `5.19.12` or later.
- Apache ActiveMQ KahaDB: same fixed versions as above.

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111821

## From the sources

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.



A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. 



This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.



Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_