CVE-2026-40046: Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for ": MQ

CVE-2026-40046 · Severity: high · CVSS 7.5 · Published 2026-04-09

Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability in how it handles MQTT protocol messages could allow an attacker to cause unexpected behavior or minor data exposure. This issue occurred because a previous security fix was accidentally omitted from newer versions of the software.

Technologies: Apache Software Foundation ActiveMQ All, org.apache.activemq:activemq-all (Maven), org.apache.activemq:apache-activemq (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-40046 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40046 being exploited in the wild.
How severe is CVE-2026-40046?
High severity, with a CVSS score of 7.5, published 9 April 2026.
Which products and versions are affected?
Apache Software Foundation ActiveMQ All 6.0.0 to 6.2.3; Apache Software Foundation ActiveMQ MQTT 6.0.0 to 6.2.3; org.apache.activemq:activemq-all (Maven) >= 6.0.0, < 6.2.4, ECOSYSTEM:introduced=6.0.0,fixed=6.2.4; org.apache.activemq:activemq-mqtt (Maven) >= 6.0.0, < 6.2.4, ECOSYSTEM:introduced=6.0.0,fixed=6.2.4; and 1 more.
Is there a fix for CVE-2026-40046?
Yes. org.apache.activemq:activemq-all (Maven): upgrade to 6.2.4 or later; org.apache.activemq:activemq-mqtt (Maven): upgrade to 6.2.4 or later; org.apache.activemq:apache-activemq (Maven): upgrade to 6.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40046 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40046?
Check whether you run Apache Software Foundation ActiveMQ All, Apache Software Foundation ActiveMQ MQTT, org.apache.activemq:activemq-all (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.activemq:activemq-all (Maven): upgrade to 6.2.4 or later
    # set org.apache.activemq:activemq-all to 6.2.4 in your pom.xml or build.gradle
  • org.apache.activemq:activemq-mqtt (Maven): upgrade to 6.2.4 or later
    # set org.apache.activemq:activemq-mqtt to 6.2.4 in your pom.xml or build.gradle
  • org.apache.activemq:apache-activemq (Maven): upgrade to 6.2.4 or later
    # set org.apache.activemq:apache-activemq to 6.2.4 in your pom.xml or build.gradle

Technical details

An integer overflow or wraparound vulnerability exists in the MQTT implementation of Apache ActiveMQ. The root cause is the improper validation of the 'remaining length' field within MQTT control packets, a flaw that was previously addressed in the 5.19.x branch but regressed in the 6.0.0+ release line. A remote attacker with network access and low privileges can exploit this by sending specially crafted MQTT packets. This can lead to a loss of confidentiality and integrity, though it is primarily categorized as a moderate risk. The issue is resolved in version 6.2.4 and was previously fixed in 5.19.2.

Affected products

  • Apache ActiveMQ 6.0.0 to 6.2.3
  • Apache ActiveMQ All 6.0.0 to 6.2.3
  • Apache ActiveMQ MQTT 6.0.0 to 6.2.3

Identifiers

  • CVE-2026-40046
  • GHSA-xvqc-pp94-fmpx

Timeline

  • 2026-04-09: disclosed
  • 2026-04-09: advisory
  • 2026-04-09: patched: Version 6.2.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.