CVE-2026-40046 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound
An integer overflow in MQTT packet validation allows attackers to cause denial of service or potentially execute code on Apache ActiveMQ servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40046?
CVE-2026-40046 is a high-severity vulnerability in Apache ActiveMQ, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.
The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.
Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.
Weakness: CWE-190
Which versions are affected by CVE-2026-40046?
7 open source packages ship an affected version, including org.apache.activemq:activemq-all, activemq and org.apache.activemq:activemq-mqtt.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.activemq:activemq-all Maven | From 6.0.0 | 6.2.4 |
org.apache.activemq:activemq-all Maven | From 6.0.0 | 6.2.4 |
activemq Bitnami | From 6.0.0 | 6.2.4 |
org.apache.activemq:activemq-mqtt Maven | From 6.0.0 | 6.2.4 |
org.apache.activemq:activemq-mqtt Maven | From 6.0.0 | 6.2.4 |
org.apache.activemq:apache-activemq Maven | From 6.0.0 | 6.2.4 |
1 more packages
org.apache.activemq:apache-activemq Maven | From 6.0.0 | 6.2.4 |
How do I fix CVE-2026-40046?
Upgrade org.apache.activemq:activemq-all to 6.2.4 or later.
Is CVE-2026-40046 being exploited?
There is no known exploitation of CVE-2026-40046 in the wild and no public exploit code.
Sources
Also known as BIT-activemq-2026-40046, GHSA-xvqc-pp94-fmpx, MINI-2357-m62r-g5h3, MINI-5755-w8q6-8rcm, MINI-9545-h8fw-8wxx, MINI-vq2w-rqhm-q6r8 and 2 more.