# CVE-2026-40046: Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for ": MQ

Source: https://junglewise.ai/threats/cve-2026-40046-apache-activemq-integer-overflow-in-mqtt-control-packet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40046 · Severity: high · CVSS 7.5 · Published 2026-04-09

Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability in how it handles MQTT protocol messages could allow an attacker to cause unexpected behavior or minor data exposure. This issue occurred because a previous security fix was accidentally omitted from newer versions of the software.

Technologies: [Apache Software Foundation ActiveMQ All](https://junglewise.ai/threats/technologies/activemq-all), [org.apache.activemq:activemq-all (Maven)](https://junglewise.ai/threats/technologies/org-apache-activemq-activemq-all), [org.apache.activemq:apache-activemq (Maven)](https://junglewise.ai/threats/technologies/org-apache-activemq-apache-activemq). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-40046 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40046 being exploited in the wild.

**How severe is CVE-2026-40046?** High severity, with a CVSS score of 7.5, published 9 April 2026.

**Which products and versions are affected?** Apache Software Foundation ActiveMQ All 6.0.0 to 6.2.3; Apache Software Foundation ActiveMQ MQTT 6.0.0 to 6.2.3; org.apache.activemq:activemq-all (Maven) >= 6.0.0, < 6.2.4, ECOSYSTEM:introduced=6.0.0,fixed=6.2.4; org.apache.activemq:activemq-mqtt (Maven) >= 6.0.0, < 6.2.4, ECOSYSTEM:introduced=6.0.0,fixed=6.2.4; and 1 more.

**Is there a fix for CVE-2026-40046?** Yes. org.apache.activemq:activemq-all (Maven): upgrade to 6.2.4 or later; org.apache.activemq:activemq-mqtt (Maven): upgrade to 6.2.4 or later; org.apache.activemq:apache-activemq (Maven): upgrade to 6.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40046 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40046?** Check whether you run Apache Software Foundation ActiveMQ All, Apache Software Foundation ActiveMQ MQTT, org.apache.activemq:activemq-all (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.activemq:activemq-all (Maven): upgrade to 6.2.4 or later

  ```sh
  # set org.apache.activemq:activemq-all to 6.2.4 in your pom.xml or build.gradle
  ```

- org.apache.activemq:activemq-mqtt (Maven): upgrade to 6.2.4 or later

  ```sh
  # set org.apache.activemq:activemq-mqtt to 6.2.4 in your pom.xml or build.gradle
  ```

- org.apache.activemq:apache-activemq (Maven): upgrade to 6.2.4 or later

  ```sh
  # set org.apache.activemq:apache-activemq to 6.2.4 in your pom.xml or build.gradle
  ```


## Technical details

An integer overflow or wraparound vulnerability exists in the MQTT implementation of Apache ActiveMQ. The root cause is the improper validation of the 'remaining length' field within MQTT control packets, a flaw that was previously addressed in the 5.19.x branch but regressed in the 6.0.0+ release line. A remote attacker with network access and low privileges can exploit this by sending specially crafted MQTT packets. This can lead to a loss of confidentiality and integrity, though it is primarily categorized as a moderate risk. The issue is resolved in version 6.2.4 and was previously fixed in 5.19.2.

## Affected products

- Apache ActiveMQ 6.0.0 to 6.2.3
- Apache ActiveMQ All 6.0.0 to 6.2.3
- Apache ActiveMQ MQTT 6.0.0 to 6.2.3

## Identifiers

- CVE-2026-40046
- GHSA-xvqc-pp94-fmpx

## Timeline

- 2026-04-09: disclosed
- 2026-04-09: advisory
- 2026-04-09: patched: Version 6.2.4 released

## References

- [https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt](https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt)
- [https://lists.apache.org/thread/zdntj5rcgjjzrpow84o339lzldy68zrg](https://lists.apache.org/thread/zdntj5rcgjjzrpow84o339lzldy68zrg)
- [https://www.cve.org/CVERecord?id=CVE-2025-66168](https://www.cve.org/CVERecord?id=CVE-2025-66168)

## Related threats

- [Apache ActiveMQ missing authorization in temporary destinations](https://junglewise.ai/threats/cve-2026-54475-apache-activemq-missing-authorization-in-temporary-destinations)
- [Apache ActiveMQ DoS via excessive memory allocation in OpenWire map unmarshaling](https://junglewise.ai/threats/cve-2026-53917-apache-activemq-dos-via-excessive-memory-allocation-in-openwire)
- [Apache ActiveMQ denial of service via STOMP NIO heap exhaustion](https://junglewise.ai/threats/cve-2026-53916-apache-activemq-denial-of-service-via-stomp-nio-heap-exhaustion)
- [Apache ActiveMQ stored XSS in Web Console browse page](https://junglewise.ai/threats/cve-2026-52760-apache-activemq-stored-xss-in-web-console-browse-page)
- [Apache ActiveMQ Denial of Service via Out of Memory](https://junglewise.ai/threats/cve-2026-50750-apache-activemq-denial-of-service-via-out-of-memory)