An integer overflow or wraparound flaw exists in the handling of the MQTT control packet remaining length field. The vulnerability originates from a missing validation that was corrected only in 5.19.2 and later releases, but the patch was omitted in all 6.0.0 and higher releases up to 6.2.3. Using an unvalidated length field can lead to a corrupted packet parsing state, which in turn can crash the broker or render it unresponsive.

The affected products are Apache ActiveMQ, Apache ActiveMQ All, and Apache ActiveMQ MQTT released by the Apache Software Foundation. All 6.0.0 through 6.2.3 versions are vulnerable. Versions 6.0.0 to before 6.2.4 (inclusive) are impacted. The 5.19.x line is vulnerable only before 5.19.2; versions 5.19.2 and newer, including the current 5.19.5, contain the fix.

No CVSS score is published and the EPSS score is unavailable, but the common weakness (integer overflow) suggests a moderate to high risk. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation would require sending a specially crafted MQTT packet to the broker, which a remote actor can do by establishing a connection. Until the broker is updated, the system remains at risk of service interruption.