CVE-2026-40046
Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.
Impact
Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions. This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.activemq:apache-activemq | >= 6.0.0, < 6.2.4 | 6.2.4 |
| maven | org.apache.activemq:activemq-all | >= 6.0.0, < 6.2.4 | 6.2.4 |
| maven | org.apache.activemq:activemq-mqtt | >= 6.0.0, < 6.2.4 | 6.2.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Apache ActiveMQ: From 6.0.0 | before 6.2.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt
- https://lists.apache.org/thread/zdntj5rcgjjzrpow84o339lzldy68zrg
- https://www.cve.org/CVERecord?id=CVE-2025-66168
- https://github.com/advisories/GHSA-xvqc-pp94-fmpx
- https://nvd.nist.gov/vuln/detail/CVE-2026-40046