CVE-2025-66168
highpriority · track · 35EPSS 0.008 · 56 %ileDEEUJPRUUSEPSS · scored 2026-10-23
WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=CVE-2026-40046 Original Report: Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted. This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0 Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.4–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (44)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux Apache Camel for Spring Bootall versionscert_bundDEcpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0591Apache ActiveMQ/Artemis: Mehrere SchwachstellenDeutsch2026-03-03csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ/Artemis ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2026-3043IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2026-08-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.
- GHSA-c825-6ph3-4h84Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound2026-03-04ghsa · osvUS
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted. This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0 Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
- BIT-activemq-2025-66168Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated2026-03-06vendor · osvUS
WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=CVE-2026-40046 Original Report: Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted. This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0 Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
- JVNDB-2026-006408JVN iPedia advisory JVNDB-2026-0064082026-04-24vendor · jvndbJP
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/03/03/5cnnvd
- https://access.redhat.com/security/cve/cve-2025-66168cnnvd
- https://activemq.apache.org/Patchcnnvd
- https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txtcnnvd
- https://lists.apache.org/thread/13n8mkrb2jf2y6yyhpgrkmpqcm7djytocnnvd
- https://www.cve.org/CVERecord?id=CVE-2026-40046cnnvd
- https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txtenisa_euvd
- https://lists.apache.org/thread/13n8mkrb2jf2y6yyhpgrkmpqcm7djytoenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan