The vulnerability occurs when ActiveMQ does not properly validate the MQTT remaining length field, allowing a malformed packet to overflow the integer used to calculate the total Remaining Length. This overflow can lead the broker to incorrectly parse the payload as multiple MQTT control packets, violating the MQTT v3.1.1 specification that limits Remaining Length to 4 bytes. The result is unexpected broker behavior that could include errors, misrouting, or service disruption, reflecting weaknesses in integer handling and calculation. The primary impact is to the broker’s availability and reliability during MQTT communication.

Affected versions are Apache ActiveMQ prior to 5.19.2, 6.0.0 through 6.1.8, and 6.2.0 for all modules, including the MQTT module. Users of 6.x should upgrade to 6.2.4 or later, while earlier releases must update to at least 5.19.2, 6.1.9, or 6.2.1. Systems that do not enable MQTT transport connectors are not impacted.

With a CVSS score of 5.4 and an EPSS score under 1%, the exploitation probability is low, and the vulnerability is not listed in CISA’s KEV catalog. However, the flaw can be triggered on an established, authenticated MQTT connection over an enabled transport connector. An attacker feeding a crafted packet can exploit the integer overflow to cause the broker to misinterpret the payload, potentially disrupting its operation. The attack does not require privileged access and can be deployed remotely by any client that can send MQTT traffic to the broker.