Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Apache ActiveMQ before 6.2.4 may mis‑handle MQTT messages

CVE-2026-40046 · published 6 months ago
Summary

Versions of Apache ActiveMQ 6.0.0 through 6.2.3, including the All and MQTT packages, can mis‑interpret the size information in MQTT data, which could allow an attacker to cause the software to behave incorrectly. Upgrading to version 6.2.4 or any 5.19.2 or later release resolves the problem. Apply the update promptly to keep your messaging system safe.

What to do
  • Update apache org.apache.activemq:apache-activemq to version 6.2.4.
  • Update apache org.apache.activemq:activemq-all to version 6.2.4.
  • Update apache org.apache.activemq:activemq-mqtt to version 6.2.4.
  • Update activemq to version 6.2.4.
  • Update apache org.apache.activemq:activemq-all to version 6.1.3-aikido.5.
  • Update root io.root.org.apache.activemq:activemq-all to version 6.1.3-root.io.5.
  • Update apache org.apache.activemq:activemq-mqtt to version 6.1.3-aikido.5.
  • Update root io.root.org.apache.activemq:activemq-mqtt to version 6.1.3-root.io.5.
  • Update apache org.apache.activemq:activemq-all to version 6.1.3-aikido.6.
  • Update root io.root.org.apache.activemq:activemq-all to version 6.1.3-root.io.6.
  • Update apache org.apache.activemq:activemq-mqtt to version 6.1.3-aikido.6.
  • Update root io.root.org.apache.activemq:activemq-mqtt to version 6.1.3-root.io.6.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.activemq:apache-activemq >= 6.0.0, < 6.2.4
Fix: upgrade to 6.2.4
maven apache org.apache.activemq:activemq-all >= 6.0.0, < 6.2.4
Fix: upgrade to 6.2.4
maven apache org.apache.activemq:activemq-mqtt >= 6.0.0, < 6.2.4
Fix: upgrade to 6.2.4
Bitnami – activemq >= 6.0.0, < 6.2.4
Fix: upgrade to 6.2.4
Root:Maven apache org.apache.activemq:activemq-all < 6.1.3-aikido.5
< 6.1.3-aikido.6
Fix: upgrade to 6.1.3-aikido.5
Root:Maven root io.root.org.apache.activemq:activemq-all < 6.1.3-root.io.5
< 6.1.3-root.io.6
Fix: upgrade to 6.1.3-root.io.5
Root:Maven apache org.apache.activemq:activemq-mqtt < 6.1.3-aikido.5
< 6.1.3-aikido.6
Fix: upgrade to 6.1.3-aikido.5
Root:Maven root io.root.org.apache.activemq:activemq-mqtt < 6.1.3-root.io.5
< 6.1.3-root.io.6
Fix: upgrade to 6.1.3-root.io.5
Ubuntu:Pro:16.04:LTS canonical activemq All versions
Original advisory text
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound
Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.


This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.



Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-190Integer Overflow
Timeline
Published9 Apr 2026
Updated4 Nov 2026
First seen9 Apr 2026
Sources
CVE-2026-40046 · NVD
GHSA-xvqc-pp94-fmpx · GHSA
BIT-activemq-2026-40046 · OSV
ROOT-APP-MAVEN-CVE-2026-40046 · OSV
UBUNTU-CVE-2026-40046 · OSV
Track software like this
Free during beta