CVE-2025-66168: Apache ActiveMQ Integer Overflow Vulnerability
Summary
CVE-2025-66168: Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound. Affects org.apache.activemq:apache-activemq across 3 version ranges.
< 5.19.2
>= 6.0.0, < 6.1.9
>= 6.2.0, < 6.2.1
Fixed in 5.19.2, 6.1.9 or 6.2.1, depending on the release line you run. How to fix ↓
Also tracked for
- activemq · Bitnami
The same CVE-2025-66168 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is a popular open-source messaging server that facilitates communication between applications through the Java Message Service (JMS) API. It supports various messaging protocols, including MQTT, and is widely used for building scalable and reliable messaging systems. This vulnerability arises from improper validation of the remaining length field in MQTT packets, potentially leading to unexpected behavior in the broker.
Vulnerability Detail
The vulnerability in Apache ActiveMQ is an integer overflow or wraparound issue that occurs due to inadequate validation of the remaining length field during the decoding of malformed MQTT packets. When an overflow happens, ActiveMQ may miscalculate the total remaining length, interpreting the payload as multiple MQTT control packets. This can lead to unexpected behavior when interacting with non-compliant clients, violating the MQTT v3.1.1 specification, which restricts the remaining length to a maximum of 4 bytes. The vulnerability affects established connections after the authentication process and primarily impacts versions prior to 5.19.2, 6.0.0 to 6.1.8, and 6.2.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.19.25.19.2 -
>= 6.0.0, < 6.1.96.1.9 -
>= 6.2.0, < 6.2.16.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately feasible, consider disabling the MQTT transport connectors on the broker to mitigate the risk associated with this vulnerability. This can be done by modifying the broker configuration to exclude MQTT transport settings.
Conclusion
The integer overflow vulnerability in Apache ActiveMQ (CVE-2025-66168) poses a risk to applications using affected versions of the messaging server. Users are strongly advised to upgrade to the latest patched versions to mitigate potential security issues. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for org.apache.activemq:apache-activemq →
FAQ
CVE-2025-66168 is a vulnerability in Apache ActiveMQ that allows for integer overflow due to improper validation of MQTT packet lengths.
The vulnerability affects Apache ActiveMQ versions before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0.
The vulnerability can lead to unexpected behavior in the broker, including misinterpretation of MQTT packets, which may compromise the integrity of message delivery.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the pom.xml file. You can also check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:apache-activemq.
