PT-2026-31651 · Apache · Apache Activemq

Adrien Bernard · Published 2026-03-04 · Updated 2026-05-03 · CVE-2026-40046

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 6.0.0 through 6.1.8, 6.2.0, and prior to 5.19.2

Description An integer overflow or wraparound issue exists in Apache ActiveMQ when decoding malformed packets. This occurs due to improper validation of the remaining length field in MQTT control packets, potentially leading to misinterpretation of the payload and unexpected broker behavior when interacting with non-compliant clients. The issue violates the MQTT v3.1.1 specification, which limits the Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after authentication. Brokers not using MQTT transport connectors are not impacted.

Recommendations Upgrade to version 5.19.2 or later. Upgrade to version 6.1.9. Upgrade to version 6.2.1. Upgrade to version 6.2.4 or later.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-ACTIVEMQ-2025-66168

BIT-ACTIVEMQ-2026-40046

CVE-2026-40046

GHSA-C825-6PH3-4H84

GHSA-XVQC-PP94-FMPX

OESA-2026-2124

OESA-2026-2125

OESA-2026-2126

OESA-2026-2127

Affected Products

Apache Activemq

References · 31

• https://lists.apache.org/thread/zdntj5rcgjjzrpow84o339lzldy68zrg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41044 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-66168 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2126 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c825-6ph3-4h84 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2127 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2125 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-activemq-2025-66168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39304 · Security Note
• https://ubuntu.com/security/CVE-2026-40046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40466 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2124 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33227 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-40046 · Security Note