CVE-2026-40046

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated

7.5 HighFix available

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.

This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.38%Up 0.4 points since Apr 10, 2026

What each source reports

CVE List Score used7.5

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.

This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Record: CVE-2026-40046
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

EUVDEUVD-2026-209567.5

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.

This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Record: EUVD-2026-20956
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xvqc-pp94-fmpx5.4

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions. This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Record: GHSA-xvqc-pp94-fmpx
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-190
Updated: 2026-11-02

NVD7.5

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.

This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Record: CVE-2026-40046
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSVGHSA-xvqc-pp94-fmpx5.4

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Record: GHSA-xvqc-pp94-fmpx
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-190
Updated: 2026-11-02

OSVOESA-2026-21248.8

activemq security update

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

'Severity: low \n\nAffected versions:\n\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.3\n- Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.2\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.3\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.2\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.2\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.3\n- Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.2\n\nDescription:\n\nImproper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ \nBroker, Apache ActiveMQ All.\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user \nprovided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the \napplication is exposed to a classpath path resource loading vulnerability that could potentially be chained together \nwith another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before \n6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 \nbefore 6.2.2.\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix \nthis issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and \n6.2.3.\n\nCredit:\n\nDawei Wang (finder)\n\nReferences:'

"Severity: important \n\nAffected versions:\n\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.4\n- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.3\n- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.4\n- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.3\n\nDescription:\n\nImproper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ \nBroker, Apache ActiveMQ.\n\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at\xa0/api/jolokia/ on the web console. The default Jolokia \naccess policy permits\xa0exec operations on all ActiveMQ\xa0MBeans (org.apache.activemq:*), including\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). \n\nAn authenticated attacker can\xa0invoke these operations with a crafted discovery URI that triggers the VM\xa0transport's \nbrokerConfig parameter to load a remote Spring XML application\xa0context using ResourceXmlApplicationContext. \nBecause Spring's\xa0ResourceXmlApplicationContext instantiates all singleton beans before the\xa0BrokerService validates the \nconfiguration, arbitrary code execution occurs\xa0on the broker's JVM through bean factory methods such as Runtime.exec().\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .\n\nUsers are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n\nCredit:\n\nNaveen Sunkavally (Horizon3.ai) (finder)\n\nReferences:"

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a…

Record: OESA-2026-2124
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVOESA-2026-21258.8

activemq security update

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a…

Record: OESA-2026-2125
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-21268.8

activemq security update

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a…

Record: OESA-2026-2126
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-21278.8

activemq security update

The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a…

Record: OESA-2026-2127
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-400467.5

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions. This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Record: UBUNTU-CVE-2026-40046
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-activemq-2026-40046No score

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.

This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.

Record: BIT-activemq-2026-40046
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2026-40046No score

CVE-2026-40046 in io.root.org.apache.activemq:activemq-all - Patched by Root

Root has patched CVE-2026-40046 in the io.root.org.apache.activemq:activemq-all package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2026-40046
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.activemq:apache-activemq` Maven	6.0.0 up to 6.2.4	6.2.4
`org.apache.activemq:activemq-all` Maven	6.0.0 up to 6.2.4	6.2.4
`org.apache.activemq:activemq-mqtt` Maven	6.0.0 up to 6.2.4	6.2.4
`activemq` Bitnami	6.0.0 up to 6.2.4	6.2.4
`org.apache.activemq:apache-activemq` Maven	6.0.0 up to 6.2.4, plus listed versions 6.0.16.1.06.1.16.1.26.1.3 Show 9 moreShow less 6.1.46.1.56.1.66.1.76.1.86.2.06.2.16.2.26.2.3	6.2.4
`org.apache.activemq:activemq-all` Maven	6.0.0 up to 6.2.4, plus listed versions 6.0.16.1.06.1.16.1.26.1.3 Show 9 moreShow less 6.1.46.1.56.1.66.1.76.1.86.2.06.2.16.2.26.2.3	6.2.4
`org.apache.activemq:activemq-mqtt` Maven	6.0.0 up to 6.2.4, plus listed versions 6.0.16.1.06.1.16.1.26.1.3 Show 9 moreShow less 6.1.46.1.56.1.66.1.76.1.86.2.06.2.16.2.26.2.3	6.2.4
`activemq` openEuler:22.03-LTS-SP4 From an advisory covering 7 CVEs	before 5.19.6-1.oe2203sp4	5.19.6-1.oe2203sp4
`activemq` openEuler:24.03-LTS From an advisory covering 7 CVEs	before 5.19.6-1.oe2403	5.19.6-1.oe2403
`activemq` openEuler:24.03-LTS-SP1 From an advisory covering 7 CVEs	before 5.19.6-1.oe2403sp1	5.19.6-1.oe2403sp1

Show 13 moreShow less

Affected packages
Package	Affected	Fixed
`activemq` openEuler:24.03-LTS-SP3 From an advisory covering 7 CVEs	before 5.19.6-1.oe2403sp3	5.19.6-1.oe2403sp3
`io.root.org.apache.activemq:activemq-all` Root:Maven	before 6.1.3-root.io.5	6.1.3-root.io.56.1.3-root.io.66.1.3-root.io.76.1.3-root.io.8
`io.root.org.apache.activemq:activemq-mqtt` Root:Maven	before 6.1.3-root.io.5	6.1.3-root.io.56.1.3-root.io.66.1.3-root.io.76.1.3-root.io.8
`org.apache.activemq:activemq-all` Root:Maven	before 6.1.3-aikido.5	6.1.3-aikido.56.1.3-aikido.66.1.3-aikido.76.1.3-aikido.8
`org.apache.activemq:activemq-mqtt` Root:Maven	before 6.1.3-aikido.5	6.1.3-aikido.56.1.3-aikido.66.1.3-aikido.76.1.3-aikido.8
`activemq` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-25.13.2+dfsg-2ubuntu0.1~esm1	None known
`activemq` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 5.14.5-35.15.2-25.15.3-25.15.8-2~18.045.15.8-2~18.04.1~esm1	None known
`activemq` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 5.15.10-15.15.11-15.15.11-1ubuntu0.1~esm1	None known
`activemq` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 5.16.1-15.16.1-1ubuntu0.1~esm15.16.1-1ubuntu0.1	None known
`activemq` Ubuntu:24.04:LTS	All versions, plus listed versions 5.17.2+dfsg-25.17.6+dfsg-1	None known
`activemq` Ubuntu:25.10	All versions, plus listed versions 5.17.6+dfsg-15.17.6+dfsg-2	None known
`activemq` Ubuntu:26.10	All versions, plus listed versions 5.17.6+dfsg-25.17.6+dfsg-2ubuntu1	None known
`activemq` Ubuntu:26.04:LTS	All versions, plus listed versions 5.17.6+dfsg-2	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40046 is a high vulnerability (CVSS 7.5) in Apache Software Foundation Activemq, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in org.apache.activemq:apache-activemq 6.2.4.

References

Show 11 moreShow less

This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.