CVE-2026-40046

HIGH

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated

Title source: cna
STIX 2.1

Description

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions. This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

References (3)

Scores

CVSS v3 7.5
EPSS 0.0005
EPSS Percentile 15.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-190
Status published
Products (6)
Apache Software Foundation/Apache ActiveMQ 6.0.0 - 6.2.4
Apache Software Foundation/Apache ActiveMQ All 6.0.0 - 6.2.4
Apache Software Foundation/Apache ActiveMQ MQTT 6.0.0 - 6.2.4
org.apache.activemq/activemq-all 6.0.0 - 6.2.4Maven
org.apache.activemq/activemq-mqtt 6.0.0 - 6.2.4Maven
org.apache.activemq/apache-activemq 6.0.0 - 6.2.4Maven
Published Apr 09, 2026
Tracked Since Apr 09, 2026