Executive brief
Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability in how it handles MQTT protocol messages could allow an attacker to cause unexpected behavior or minor data exposure. This issue occurred because a previous security fix was accidentally omitted from newer versions of the software.
Technical details
An integer overflow or wraparound vulnerability exists in the MQTT implementation of Apache ActiveMQ. The root cause is the improper validation of the 'remaining length' field within MQTT control packets, a flaw that was previously addressed in the 5.19.x branch but regressed in the 6.0.0+ release line. A remote attacker with network access and low privileges can exploit this by sending specially crafted MQTT packets. This can lead to a loss of confidentiality and integrity, though it is primarily categorized as a moderate risk. The issue is resolved in version 6.2.4 and was previously fixed in 5.19.2.
Affected products
- Apache ActiveMQ 6.0.0 to 6.2.3
- Apache ActiveMQ All 6.0.0 to 6.2.3
- Apache ActiveMQ MQTT 6.0.0 to 6.2.3
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory
- 2026-04-09: patched: Version 6.2.4 released