CVE-2025-66168: Apache ActiveMQ integer overflow in MQTT packet decoding

CVE-2025-66168 · Severity: medium · CVSS 5.4 · Published 2026-03-04

Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability in its MQTT protocol handling allows an authenticated user to send specially crafted messages that cause the system to misinterpret data. This can lead to unexpected behavior or unauthorized data access within the messaging environment.

Technologies: org.apache.activemq:activemq-all (Maven), org.apache.activemq:apache-activemq (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2025-66168 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-66168 being exploited in the wild.
How severe is CVE-2025-66168?
Medium severity, with a CVSS score of 5.4, published 4 March 2026.
Which products and versions are affected?
Apache Software Foundation ActiveMQ All Module < 5.19.2, 6.0.0 to 6.2.3; Apache Software Foundation ActiveMQ MQTT Module < 5.19.2, 6.0.0 to 6.2.3; org.apache.activemq:activemq-all (Maven) ECOSYSTEM:introduced=0,fixed=5.19.2; org.apache.activemq:activemq-mqtt (Maven) ECOSYSTEM:introduced=0,fixed=5.19.2; and 1 more.
Is there a fix for CVE-2025-66168?
Yes. org.apache.activemq:activemq-all (Maven): upgrade to 5.19.2 or later; org.apache.activemq:activemq-mqtt (Maven): upgrade to 5.19.2 or later; org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66168 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-66168?
Check whether you run Apache Software Foundation ActiveMQ All Module, Apache Software Foundation ActiveMQ MQTT Module, org.apache.activemq:activemq-all (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.activemq:activemq-all (Maven): upgrade to 5.19.2 or later
    # set org.apache.activemq:activemq-all to 5.19.2 in your pom.xml or build.gradle
  • org.apache.activemq:activemq-mqtt (Maven): upgrade to 5.19.2 or later
    # set org.apache.activemq:activemq-mqtt to 5.19.2 in your pom.xml or build.gradle
  • org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.2 or later
    # set org.apache.activemq:apache-activemq to 5.19.2 in your pom.xml or build.gradle

Technical details

An integer overflow vulnerability (CWE-190) exists in Apache ActiveMQ's decoding of MQTT control packets. The broker fails to properly validate the 'remaining length' field, which according to the MQTT v3.1.1 specification should be restricted to a maximum of 4 bytes. By providing a malformed length field, an attacker with an established, authenticated connection can trigger an overflow, causing the broker to incorrectly compute the total payload size and misinterpret a single packet as multiple control packets. This vulnerability specifically impacts brokers with MQTT transport connectors enabled. While initial patches were released in the 6.1.x and 6.2.x lines, subsequent advisories indicate the fix was missed for the 6.x branch until version 6.2.4.

Affected products

  • Apache ActiveMQ < 5.19.2, 6.0.0 to 6.2.3
  • Apache ActiveMQ All Module < 5.19.2, 6.0.0 to 6.2.3
  • Apache ActiveMQ MQTT Module < 5.19.2, 6.0.0 to 6.2.3

Identifiers

  • CVE-2025-66168
  • GHSA-c825-6ph3-4h84

Timeline

  • 2026-03-03: disclosed: Initial public disclosure on oss-security mailing list
  • 2026-03-04: advisory: GitHub Advisory published
  • 2026-04-10: other: Advisory updated to reflect that the fix was missed in early 6.x releases

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.