CVE-2026-40046

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated

State: Published
Severity: 7.5 High
Published: Apr 9, 2026
Updated: Apr 10, 2026
Reserved: Apr 8, 2026

Read the record on cve.org

Description

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.

This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
Apache ActiveMQApache Software Foundation	6.0.0 to before 6.2.4Affected
Apache ActiveMQ AllApache Software Foundation	6.0.0 to before 6.2.4Affected
Apache ActiveMQ MQTTApache Software Foundation	6.0.0 to before 6.2.4Affected

References

https://www.cve.org/CVERecord?id=CVE-2025-66168related
https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txtvendor-advisory
https://lists.apache.org/thread/zdntj5rcgjjzrpow84o339lzldy68zrgvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.