GHSA-c825-6ph3-4h84

Source

https://github.com/advisories/GHSA-c825-6ph3-4h84

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c825-6ph3-4h84/GHSA-c825-6ph3-4h84.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-c825-6ph3-4h84

Aliases

BIT-activemq-2025-66168
CVE-2025-66168

Published

2026-03-04T09:31:07Z

Modified

2026-03-08T23:11:16.546958Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

Details

Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.

Database specific

{
    "nvd_published_at": "2026-03-04T09:15:54Z",
    "cwe_ids": [
        "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-04T22:19:25Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven

org.apache.activemq:apache-activemq

Package

Name: org.apache.activemq:apache-activemq; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.19.2

Affected versions

4.*

4.1.1

4.1.2

5.*

5.0.0

5.1.0

5.2.0

5.3.0

5.3.1

5.3.2

5.4.0

5.4.1

5.4.2

5.4.3

5.5.0

5.5.1

5.6.0

5.7.0

5.8.0

5.9.0

5.9.1

5.10.0

5.10.1

5.10.2

5.11.0

5.11.1

5.11.2

5.11.3

5.11.4

5.12.0

5.12.1

5.12.2

5.12.3

5.13.0

5.13.1

5.13.2

5.13.3

5.13.4

5.13.5

5.14.0

5.14.1

5.14.2

5.14.3

5.14.4

5.14.5

5.15.0

5.15.1

5.15.2

5.15.3

5.15.4

5.15.5

5.15.6

5.15.7

5.15.8

5.15.9

5.15.10

5.15.11

5.15.12

5.15.13

5.15.14

5.15.15

5.15.16

5.16.0

5.16.1

5.16.2

5.16.3

5.16.4

5.16.5

5.16.6

5.16.7

5.16.8

5.17.0

5.17.1

5.17.2

5.17.3

5.17.4

5.17.5

5.17.6

5.17.7

5.18.0

5.18.1

5.18.2

5.18.3

5.18.4

5.18.5

5.18.6

5.18.7

5.19.0

5.19.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c825-6ph3-4h84/GHSA-c825-6ph3-4h84.json"

org.apache.activemq:apache-activemq

Package

Name: org.apache.activemq:apache-activemq; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.1.9

Affected versions

6.*

6.0.0

6.0.1

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.1.5

6.1.6

6.1.7

6.1.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c825-6ph3-4h84/GHSA-c825-6ph3-4h84.json"

org.apache.activemq:apache-activemq

Package

Name: org.apache.activemq:apache-activemq; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.2.1

Affected versions

6.*

6.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c825-6ph3-4h84/GHSA-c825-6ph3-4h84.json"

org.apache.activemq:activemq-all

Package

Name: org.apache.activemq:activemq-all; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/activemq-all

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.19.2

Affected versions

4.*

4.1.2

5.*

5.0.0

5.1.0

5.2.0

5.3.0

5.3.1

5.3.2

5.4.0

5.4.1

5.4.2

5.4.3

5.5.0

5.5.1

5.6.0

5.7.0

5.8.0

5.9.0

5.9.1

5.10.0

5.10.1

5.10.2

5.11.0

5.11.1

5.11.2

5.11.3

5.11.4

5.12.0

5.12.1

5.12.2

5.12.3

5.13.0

5.13.1

5.13.2

5.13.3

5.13.4

5.13.5

5.14.0

5.14.1

5.14.2

5.14.3

5.14.4

5.14.5

5.15.0

5.15.1

5.15.2

5.15.3

5.15.4

5.15.5

5.15.6

5.15.7

5.15.8

5.15.9

5.15.10

5.15.11

5.15.12

5.15.13

5.15.14

5.15.15

5.15.16

5.16.0

5.16.1

5.16.2

5.16.3

5.16.4

5.16.5

5.16.6

5.16.7

5.16.8

5.17.0

5.17.1

5.17.2

5.17.3

5.17.4

5.17.5

5.17.6

5.17.7

5.18.0

5.18.1

5.18.2

5.18.3

5.18.4

5.18.5

5.18.6

5.18.7

5.19.0

5.19.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c825-6ph3-4h84/GHSA-c825-6ph3-4h84.json"

org.apache.activemq:activemq-all

Package

Name: org.apache.activemq:activemq-all; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/activemq-all

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.1.9

Affected versions

6.*

6.0.0

6.0.1

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.1.5

6.1.6

6.1.7

6.1.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c825-6ph3-4h84/GHSA-c825-6ph3-4h84.json"

org.apache.activemq:activemq-all

Package

Name: org.apache.activemq:activemq-all; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/activemq-all

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.2.1

Affected versions

6.*

6.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c825-6ph3-4h84/GHSA-c825-6ph3-4h84.json"

org.apache.activemq:activemq-mqtt

Package

Name: org.apache.activemq:activemq-mqtt; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/activemq-mqtt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.19.2

Affected versions

5.*

5.8.0

5.9.0

5.9.1

5.10.0

5.10.1

5.10.2

5.11.0

5.11.1

5.11.2

5.11.3

5.11.4

5.12.0

5.12.1

5.12.2

5.12.3

5.13.0

5.13.1

5.13.2

5.13.3

5.13.4

5.13.5

5.14.0

5.14.1

5.14.2

5.14.3

5.14.4

5.14.5

5.15.0

5.15.1

5.15.2

5.15.3

5.15.4

5.15.5

5.15.6

5.15.7

5.15.8

5.15.9

5.15.10

5.15.11

5.15.12

5.15.13

5.15.14

5.15.15

5.15.16

5.16.0

5.16.1

5.16.2

5.16.3

5.16.4

5.16.5

5.16.6

5.16.7

5.16.8

5.17.0

5.17.1

5.17.2

5.17.3

5.17.4

5.17.5

5.17.6

5.17.7

5.18.0

5.18.1

5.18.2

5.18.3

5.18.4

5.18.5

5.18.6

5.18.7

5.19.0

5.19.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c825-6ph3-4h84/GHSA-c825-6ph3-4h84.json"

org.apache.activemq:activemq-mqtt

Package

Name: org.apache.activemq:activemq-mqtt; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/activemq-mqtt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.1.9

Affected versions

6.*

6.0.0

6.0.1

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.1.5

6.1.6

6.1.7

6.1.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c825-6ph3-4h84/GHSA-c825-6ph3-4h84.json"

org.apache.activemq:activemq-mqtt

Package

Name: org.apache.activemq:activemq-mqtt; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/activemq-mqtt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.2.1

Affected versions

6.*

6.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-c825-6ph3-4h84/GHSA-c825-6ph3-4h84.json"