An improper input validation vulnerability in Apache ActiveMQ and its KahaDB storage component allows a user to create a durable subscription with a clientId and subscription name whose combined length exceeds 65,535 characters. This can cause the broker to shut down and become unrecoverable. The issue affects Apache ActiveMQ versions from 6.0.0 before 6.3.3 and before 5.19.12. Upgrading to versions 6.4.0, 6.3.3, or 5.19.12 resolves the issue.