CVE-2026-111821

Overview

Apache ActiveMQ Classic is an open-source Java message broker that provides asynchronous messaging for applications. It supports JMS 1.1 and multiple wire protocols, including OpenWire, AMQP, MQTT and STOMP. Broker and client components are published as Maven artifacts under org.apache.activemq. ActiveMQ Classic is distinct from Apache ActiveMQ Artemis, which has its own broker implementation and release lines.

A denial of service vulnerability (CVE-2026-111821) has been identified in the KahaDB persistence store of Apache ActiveMQ Classic, which allows a client to create a durable subscription whose client ID and subscription name have a combined length above 65,535 characters. On a broker using KahaDB, this can shut the broker down and leave it unable to recover.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Apache ActiveMQ Classic.

‍

Details

Module Info

• Product: Apache ActiveMQ Classic
• Affected packages: org.apache.activemq:apache-activemq, org.apache.activemq:activemq-kahadb-store
• Affected versions:
  • org.apache.activemq:apache-activemq: <5.19.12, >=6.0.0 <6.3.3
  • org.apache.activemq:activemq-kahadb-store: <5.19.12, >=6.0.0 <6.3.3
• GitHub repository: https://github.com/apache/activemq
• Published packages:
  • https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq
  • https://central.sonatype.com/artifact/org.apache.activemq/activemq-kahadb-store
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Classic 5.19.12, 6.3.3, 6.4.0
  • NES for ActiveMQ v5.16.13

Vulnerability Info

This High-severity vulnerability is found in the activemq-kahadb-store package in multiple versions of Apache ActiveMQ Classic, and in the apache-activemq distribution that bundles it. When a client creates a durable topic subscription on a broker that uses KahaDB, KahaDBStore builds a subscription key by joining the client ID, a colon and the subscription name, with no limit on the result's length:

String subscriptionKey(String clientId, String subscriptionName) {
    return clientId + ":" + subscriptionName;
}

addSubscription writes that key into a KahaSubscriptionCommand, and KahaDB stores it in the journal and in its subscription indexes. The index pages serialize keys with StringMarshaller, which uses DataOutput.writeUTF:

public void writePayload(String object, DataOutput dataOut) throws IOException {
    dataOut.writeUTF(object);
}

writeUTF cannot write a string whose encoded form is longer than 65,535 bytes. Because only the combined key is too long, a client ID and a subscription name that are each under the limit still produce a key that cannot be written. The failed write inside the store can shut the broker down and leave the KahaDB store in a state the broker cannot recover from. Any client allowed to create durable subscriptions can therefore take a KahaDB-backed broker offline.

‍

Mitigation

Inactive versions of Apache ActiveMQ Classic are End-of-Life and will not receive updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Apache ActiveMQ Classic that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.