GHSA-C825-6PH3-4H84 Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

🗓️ 04 Mar 2026 09:31:07Reported by GoogleType

osv🔗 osv.dev👁 13 Views

ActiveMQ Remaining Length overflow can misinterpret MQTT payloads, affecting non compliant clients.

Reporter	Title	Published	Views	Family All 49
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	23 Jul 202618:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in activemq-all (CVE-2025-66168)	4 May 202616:07	–	ibm
Tenable Nessus	Apache ActiveMQ < 5.19.2 / 6.0.x < 6.1.9 / 6.2.0 MQTT Control Packet Validation Vulnerability (CVE-2025-66168)	5 Mar 202600:00	–	nessus
Tenable Nessus	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	7 Aug 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-66168	6 Mar 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-40046	13 Apr 202600:00	–	nessus
ATTACKERKB	CVE-2025-66168	4 Mar 202608:45	–	attackerkb
ATTACKERKB	CVE-2026-40046	9 Apr 202615:58	–	attackerkb
BDU FSTEC	The vulnerability of Apache ActiveMQ software-related to integer overflow allows attackers to cause service failures.	19 Aug 202600:00	–	bdu_fstec
Chainguard	CVE-2025-66168 vulnerabilities	18 Mar 202619:17	–	cgr

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-66168
activemq	www.activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt
github	www.github.com/apache/activemq
lists	www.lists.apache.org/thread/13n8mkrb2jf2y6yyhpgrkmpqcm7djyto
cve	www.cve.org/CVERecord
openwall	www.openwall.com/lists/oss-security/2026/03/03/5

10 Apr 2026 15:16Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.4

EPSS0.0078

ActiveMQ integer overflow Remaining Length Message Queuing Telemetry non compliant clients security vulnerability fixed versions upgrade recommendation