Package · Maven

org.apache.activemq:activemq-mqtt

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

High 7.5

CVE-2026-40046

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) relea…

Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ MQTT Ubuntu Maven

Apr 9, 2026
Medium 5.4

CVE-2025-66168

Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated

WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=C…

Apache Software Foundation Apache ActiveMQ Apache ActiveMQ MQTT Module Apache ActiveMQ All Module Debian Ubuntu Maven

Mar 4, 2026