CVE-2026-111821: Apache ActiveMQ KahaDB vulnerable to oversized client identifier poisoning (CVE-2026-111821)
Original title: CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Combined clientId and subscription name exceeding 65,535 bytes can poison the KahaDB journal in versions before 6.3.3 and 5.19.12.
Apache ActiveMQ and KahaDB have an improper input validation vulnerability. A user can create a durable subscription with a clientId and subscription name that have a combined length greater than 65,535 bytes while being shorter separately. This can poison the KahaDB journal.
Unconfirmed: No exploitation in the wild or fixed versions stated
- Combined clientId and subscription name > 65,535 bytes
- Affects durable subscriptions
- Versions before 6.3.3 and 5.19.12
Impact: Poisoning of KahaDB journal via oversized client identifiers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111821 | Improper input validation in Apache ActiveMQ KahaDB durable subscriptions | 7.5 | — |
From the original article
Posted by Christopher L. Shannon on Nov 03 Severity: important Affected versions: - Apache ActiveMQ 6. 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.