https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:33:03.170661+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-11946 bdu:2026-11946 2026-10-03T15:33:03.426652+00:00 bdu:2026-11946 https://cve.radiocsirt.org/vuln/bit-activemq-2025-66168 BIT-activemq-2025-66168 — Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is… 2026-10-03T15:33:03.426693+00:00

Affected: Bitnami: activemq

WARNING:

Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases.

See the  following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=CVE-2026-40046

Original Report:

Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 certfr-2026-avi-0933 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T15:33:03.426742+00:00 certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/euvd-2026-290340 EUVD-2026-290340 2026-10-03T15:33:03.426759+00:00 EUVD-2026-290340 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66168 fkie_cve-2025-66168 2026-10-03T15:33:03.426771+00:00

WARNING:

Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases.

See the  following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=CVE-2026-40046

Original Report:

Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-c825-6ph3-4h84 GHSA-c825-6ph3-4h84 — Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound 2026-10-03T15:33:03.426802+00:00

Affected: Maven: org.apache.activemq:apache-activemq, Maven: org.apache.activemq:activemq-all, Maven: org.apache.activemq:activemq-mqtt

Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted.

This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0

Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.

 https://cve.radiocsirt.org/vuln/jvndb-2026-006408 jvndb-2026-006408 2026-10-03T15:33:03.426835+00:00

Apache ActiveMQ series provided by The Apache Software Foundation does not properly validate the remaining length field of MQTT packets, which may lead to integer overflow and misinterpretation of MQTT packets.<a href='https://cwe.mitre.org/data/definitions/190.html' target='_blank'></a><ul><li>Integer overflow or wraparound (CWE-190) - CVE-2025-66168, CVE-2026-40046</li></ul>Gai Tanaka of Mitsui Bussan Secure Directions, Inc. reported this vulnerability in version 6.2.0 to the developer and IPA under Information Security Early Warning Partnership. JPCERT/CC coordinated with the developer to publish the advisory.

 https://cve.radiocsirt.org/vuln/oesa-2026-1607 OESA-2026-1607 — activemq security update 2026-10-03T15:33:03.426867+00:00

Affected: openEuler:24.03-LTS-SP1: activemq

The most popular and powerful open source messaging and Integration Patterns server. Security Fix(es):

A vulnerability classified as problematic has been found in Apache ActiveMQ (Application Server Software).CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.This is going to have an impact on integrity, and availability.Upgrading to version 5.19.2, 6.1.9 or 6.2.1 eliminates this vulnerability.(CVE-2025-66168)

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-66168 UBUNTU-CVE-2025-66168 2026-10-03T15:33:03.426892+00:00

Affected: Ubuntu:Pro:16.04:LTS: activemq, Ubuntu:Pro:18.04:LTS: activemq, Ubuntu:Pro:20.04:LTS: activemq, Ubuntu:Pro:22.04:LTS: activemq, Ubuntu:24.04:LTS: activemq, Ubuntu:25.10: activemq, Ubuntu:26.04:LTS: activemq

WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the  following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=CVE-2026-40046 Original Report: Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted. This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0 Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0591 WID-SEC-W-2026-0591 — Apache ActiveMQ/Artemis: Mehrere Schwachstellen 2026-10-03T15:33:03.426925+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ/Artemis ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.