Is CVE-2026-111821 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111821 being exploited in the wild.

How severe is CVE-2026-111821?

Informational severity, published 4 November 2026.

Which products and versions are affected?

Apache ActiveMQ 6.0.0 to before 6.3.3, 5.x before 5.19.12; Apache ActiveMQ KahaDB 6.0.0 to before 6.3.3, 5.x before 5.19.12.

Is there a fix for CVE-2026-111821?

Yes: fixed in ActiveMQ 6.4.0, 6.3.3, 5.19.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111821 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-111821?

Check whether you run Apache ActiveMQ or Apache ActiveMQ KahaDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111821: Apache ActiveMQ improper input validation in durable subscriptions

CVE-2026-111821 · Severity: info · Published 2026-11-04

Apache ActiveMQ is a message broker used to route and deliver messages in distributed applications. A flaw in input validation allows an attacker to create a durable subscription with combined identifiers exceeding 65,535 characters, causing the broker to shut down unexpectedly and become unrecoverable. This results in a denial of service affecting all applications relying on the broker.

Technologies: Apache ActiveMQ. Vendors: Apache.

Quick answers

Is CVE-2026-111821 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111821 being exploited in the wild.
How severe is CVE-2026-111821?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Apache ActiveMQ 6.0.0 to before 6.3.3, 5.x before 5.19.12; Apache ActiveMQ KahaDB 6.0.0 to before 6.3.3, 5.x before 5.19.12.
Is there a fix for CVE-2026-111821?: Yes: fixed in ActiveMQ 6.4.0, 6.3.3, 5.19.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111821 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-111821?: Check whether you run Apache ActiveMQ or Apache ActiveMQ KahaDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ActiveMQ 6.4.0, 6.3.3, 5.19.12

Technical details

The vulnerability is an improper input validation flaw in ActiveMQ's KahaDB persistence layer. An attacker can craft a durable subscription request where the clientId and subscription name, when combined, exceed 65,535 characters (while each individually stays below limits), triggering a broker crash. The issue requires network access to the broker and the ability to create subscriptions; no authentication bypass is involved.

Affected products

Apache ActiveMQ 6.0.0 to before 6.3.3, 5.x before 5.19.12
Apache ActiveMQ KahaDB 6.0.0 to before 6.3.3, 5.x before 5.19.12

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.