Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.19.2, 6.1.9, 6.2.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=CVE-2026-40046 Original Report: Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted. This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0 Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- org.apache.activemq:apache-activemq
fixed in 5.19.2; From 6.0.0 · fixed in 6.1.9; From 6.2.0 · fixed in 6.2.1
- org.apache.activemq:activemq-all
fixed in 5.19.2; From 6.0.0 · fixed in 6.1.9; From 6.2.0 · fixed in 6.2.1
- org.apache.activemq:activemq-mqtt
fixed in 5.19.2; From 6.0.0 · fixed in 6.1.9; From 6.2.0 · fixed in 6.2.1
- org.apache.activemq:apache-activemqMaven
fixed in 5.19.2
- org.apache.activemq:apache-activemqMaven
From 6.0.0 · fixed in 6.1.9
- org.apache.activemq:apache-activemqMaven
From 6.2.0 · fixed in 6.2.1
- org.apache.activemq:activemq-allMaven
fixed in 5.19.2
- org.apache.activemq:activemq-allMaven
From 6.0.0 · fixed in 6.1.9
- org.apache.activemq:activemq-allMaven
From 6.2.0 · fixed in 6.2.1
- org.apache.activemq:activemq-mqttMaven
fixed in 5.19.2
- org.apache.activemq:activemq-mqttMaven
From 6.0.0 · fixed in 6.1.9
- org.apache.activemq:activemq-mqttMaven
From 6.2.0 · fixed in 6.2.1