Apache ActiveMQ CVE-2026-111821

Exploitation requires (1) the broker to use the KahaDB persistence store - brokers on JDBC or other persistence are not implicated by the description - and (2) an actor able to create a durable subscription in which the clientId and subscription name are each below 65,535 bytes but sum to more than 65,535. The limiting factors are therefore the KahaDB persistence mode (not necessarily default across all deployments) and the ability to create durable subscriptions, which on a broker with authentication/authorization enabled requires valid credentials and subscription rights; on an open/unsecured broker no such barrier exists. The available sources do not state whether a secured broker is required, so the authentication barrier should be treated as deployment-dependent.

This is a denial-of-service / data-persistence integrity issue in Apache ActiveMQ brokers backed by KahaDB. No CVSS vector, EPSS score, KEV listing, or PoC reference is present in the input, and the vuln.today decision label is 'awaiting_data', so quantitative exploitation signals are simply unavailable rather than low - this should be read as incomplete telemetry, not as confirmed low risk. The vendor rates it 'important'. The mechanism is clearly described and credible: a client that can create a durable subscription supplies a clientId and a subscription name that are each individually under the 65,535-byte limit but whose combined length exceeds it, which poisons the KahaDB journal and causes the broker to shut down in an unrecoverable state. The real-world weight comes from the impact (persistent, unrecoverable broker outage affecting a widely deployed messaging backbone) and the low complexity, tempered by the fact that exploitation requires the ability to create a durable subscription on a KahaDB-backed broker and that there is no evidence of active exploitation or public exploit code. Net: credible and worth prioritizing for KahaDB deployments because of the unrecoverable availability impact, but currently with no confirmed exploitation and no independently supplied severity score to corroborate the 'important' rating.

A client able to create durable subscriptions connects to a KahaDB-backed ActiveMQ broker and registers a durable subscription whose clientId and subscription name are each shorter than 65,535 bytes but together exceed that length. This poisons the KahaDB journal and forces the broker into an unrecoverable shutdown, denying messaging service to all connected applications. No public exploit identified at time of analysis; the trigger is network-reachable and low-complexity but depends on the ability to create a durable subscription.