Improper Input Validation Vulnerability in Apache ActiveMQ by Apache

CVE-2026-111821

What is CVE-2026-111821?

An improper input validation vulnerability exists in Apache ActiveMQ, specifically affecting the KahaDB storage mechanism. Users can create a durable subscription with a combined clientId and subscription name length exceeding 65,535 characters. While each component can be shorter than this limit, exceeding it causes the broker to become unstable, potentially leading to a complete system shutdown that may be unrecoverable. It is crucial for users to upgrade to the recommended versions 6.4.0, 6.3.3, or 5.19.12 to mitigate this issue.

References