Executive brief
Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability in its MQTT protocol handling allows an authenticated user to send specially crafted messages that cause the system to misinterpret data. This can lead to unexpected behavior or unauthorized data access within the messaging environment.
Technical details
An integer overflow vulnerability (CWE-190) exists in Apache ActiveMQ's decoding of MQTT control packets. The broker fails to properly validate the 'remaining length' field, which according to the MQTT v3.1.1 specification should be restricted to a maximum of 4 bytes. By providing a malformed length field, an attacker with an established, authenticated connection can trigger an overflow, causing the broker to incorrectly compute the total payload size and misinterpret a single packet as multiple control packets. This vulnerability specifically impacts brokers with MQTT transport connectors enabled. While initial patches were released in the 6.1.x and 6.2.x lines, subsequent advisories indicate the fix was missed for the 6.x branch until version 6.2.4.
Affected products
- Apache ActiveMQ < 5.19.2, 6.0.0 to 6.2.3
- Apache ActiveMQ All Module < 5.19.2, 6.0.0 to 6.2.3
- Apache ActiveMQ MQTT Module < 5.19.2, 6.0.0 to 6.2.3
Timeline
- 2026-03-03: disclosed: Initial public disclosure on oss-security mailing list
- 2026-03-04: advisory: GitHub Advisory published
- 2026-04-10: other: Advisory updated to reflect that the fix was missed in early 6.x releases