Description
Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions. This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4. Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache ActiveMQ
Default version status: unaffected
6.0.0 to < 6.2.4affected
Apache Software Foundation Apache ActiveMQ All
Default version status: unaffected
6.0.0 to < 6.2.4affected
Apache Software Foundation Apache ActiveMQ MQTT
Default version status: unaffected
6.0.0 to < 6.2.4affected