Integer Overflow Vulnerability in Apache ActiveMQ Affects MQTT Control Packets

CVE-2025-66168

What is CVE-2025-66168?

The vulnerability in Apache ActiveMQ stems from improper validation of the remaining length field, potentially causing an integer overflow during packet decoding. This flaw can result in ActiveMQ miscalculating the total remaining length and erroneously interpreting the payload, which may lead to unexpected behaviors when interacting with non-compliant MQTT clients. This breach violates the MQTT v3.1.1 protocol specification, which limits the remaining length to a maximum of four bytes. The issue arises on established connections following successful authentication. It is advised that users upgrade to the fixed versions: 5.19.2, 6.1.9, or 6.2.1 to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References