Vulnerability · Published Apr 9, 2026 · Assigned by apache
CVE-2026-40046Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated
High 7.5
In plain English
A high-severity integer overflow in Apache ActiveMQ from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions. This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.activemq:activemq-all | 6.2.4 | GHSA-xvqc-pp94-fmpx |
| Maven | org.apache.activemq:activemq-mqtt | 6.2.4 | GHSA-xvqc-pp94-fmpx |
| Maven | org.apache.activemq:apache-activemq | 6.2.4 | GHSA-xvqc-pp94-fmpx |
| Ubuntu:24.04:LTS | activemq | no fix listed | UBUNTU-CVE-2026-40046 |
| Ubuntu:25.10 | activemq | no fix listed | UBUNTU-CVE-2026-40046 |
| Ubuntu:26.04:LTS | activemq | no fix listed | UBUNTU-CVE-2026-40046 |
| Ubuntu:26.10 | activemq | no fix listed | UBUNTU-CVE-2026-40046 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | 6.0.0 – before 6.2.4 |
| Apache Software Foundation | Apache ActiveMQ All | 6.0.0 – before 6.2.4 |
| Apache Software Foundation | Apache ActiveMQ MQTT | 6.0.0 – before 6.2.4 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H