Apache Software Foundation ActiveMQ 6.2.0
Approved changes feed: RSS · Atom
cpe:2.3:a:apache:activemq:6.2.0:*:*:*:*:*:*:*
part: a version: 6.2.0 update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Activemq (db75e7d1-71e2-5c1b-8c68-2b326744850c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/activemq |
purl2cpe | 2026-06-01 10:14:26.301480 |
pkg:deb/debian/activemq |
purl2cpe | 2026-06-01 10:14:26.301481 |
pkg:deb/ubuntu/activemq |
purl2cpe | 2026-06-01 10:14:26.301483 |
pkg:dokcer/pharmazon/activemq_artemis |
purl2cpe | 2026-06-01 10:14:26.301484 |
pkg:github/apache/activemq |
purl2cpe | 2026-06-01 10:14:26.301485 |
pkg:maven/org.apache.activemq/activemq |
purl2cpe | 2026-06-01 10:14:26.301487 |
pkg:maven/org.apache.activemq/activemq-core |
purl2cpe | 2026-06-01 10:14:26.301488 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-66168 |
vulnerable | 2026-06-08 07:39:21.311984 |
Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated
MEDIUM (5.4)
WARNING:
Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases.
See the following for more details:
https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt
https://www.cve.org/CVERecord?id=CVE-2026-40046
Original Report:
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.
This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0
Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
Published: 2026-03-04T08:45:00.932Z
Updated: 2026-04-10T10:52:27.564Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.