Threats affecting pkg:maven/org.apache.activemq/activemq-kahadb-store

CVE-2026-111821 is an improper input validation vulnerability in Apache ActiveMQ and its KahaDB storage. It allows a user to create a durable subscription with a clientId and subscription name whose combined length exceeds 65,535 characters, causing the broker to shut down and become unrecoverable. This affects Apache ActiveMQ versions from 6.0.0 up to but not including 6.3.3, and versions before 5.19.12. The issue is fixed in versions 6.3.3 and 5.19.12.