CVE-2025-66168: Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated
Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.
This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0
Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66168?
The severity of CVE-2025-66168 is considered to be high due to the potential for an overflow during the decoding of malformed MQTT packets.
How do I fix CVE-2025-66168?
To fix CVE-2025-66168, you should update Apache ActiveMQ to versions 5.19.2, 6.1.9, or 6.2.1 depending on your current version.
Which versions of Apache ActiveMQ are affected by CVE-2025-66168?
CVE-2025-66168 affects Apache ActiveMQ versions prior to 5.19.2, 6.1.9, and 6.2.1.
What implications does CVE-2025-66168 pose for MQTT communication?
CVE-2025-66168 may lead to denial of service or unpredictable behavior during MQTT communication due to the improper validation of the remaining length field.
Is there a patch available for CVE-2025-66168?
Yes, patches are available in the form of updated versions for affected Apache ActiveMQ components.