CVE-2026-111821

Full vulnerability record from the local CVENow database.

Description

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-04 10:17:25.363000

Last modified

2026-11-04 10:17:25.363000

View original CVE JSON

{
  "id": "CVE-2026-111821",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-04T10:17:25.363",
  "lastModified": "2026-11-04T10:17:25.363",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.\n\n\n\nA user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. \n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.activemq:apache-activemq",
          "packageURL": "pkg:maven/org.apache.activemq/apache-activemq",
          "versions": [
            {
              "version": "6.0.0",
              "lessThan": "6.3.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.19.12",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ KahaDB",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.activemq:activemq-kahadb-store",
          "packageURL": "pkg:maven/org.apache.activemq/activemq-kahadb-store",
          "versions": [
            {
              "version": "6.0.0",
              "lessThan": "6.3.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.19.12",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/p8gxq66lmztkrls74wkz3xh9chqd0pwl",
      "source": "[email protected]"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/11/03/19",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}