CVE-2026-111821

Severity not reported

Data quality: awaiting analysis. NVD has not completed analysis, so CVSS and affected-product data may be missing or change.

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

CVSS

—

Awaiting analysis by NVD

Timeline (UTC)

Published: 2026-11-04 10:17

Modified: 2026-11-04 14:10

NVD status: Awaiting Analysis

Last synced 10 hours ago

Verified against the source API 2026-11-04 14:34 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-20

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://lists.apache.org/thread/p8gxq66lmztkrls74wkz3xh9chqd0pwl security@apache.org
http://www.openwall.com/lists/oss-security/2026/11/03/19 af854a3a-2127-422b-91ae-364da2661108

Data sources

NVD CVE API 2.0 — fetched 2026-11-04 14:34 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores