Apache ActiveMQ Flaw Enables DoS Attacks via Malformed Network Packets
Security researchers have identified a critical vulnerability in Apache ActiveMQ, an open-source message broker widely employed by enterprises for routing data between applications.
Security researchers have identified a critical vulnerability in Apache ActiveMQ, an open-source message broker widely employed by enterprises for routing data between applications.
Identified as CVE-2025-66168, this flaw permits malicious actors to cause unexpected broker behavior and potential denial-of-service (DoS) conditions by sending specifically crafted, malformed network packets.
A successful exploitation of this vulnerability can disrupt critical internal communications and entire application ecosystems.
This issue specifically affects the MQTT module within the software, necessitating immediate patch application for organizations using this messaging protocol.
Understanding the Packet Validation Flaw
Security researcher Gai Tanaka discovered that the vulnerability involves how Apache ActiveMQ processes MQTT (Message Queuing Telemetry Transport) control packets.
MQTT is a lightweight messaging protocol typically used in internet-connected devices and environments with limited network bandwidth.
The official advisory indicates that the software fails to correctly validate the "remaining length" field in these incoming packets.
When a malformed packet bypasses this security check, it causes an integer overflow during the decoding process.
A successful exploitation of this vulnerability can disrupt critical internal communications and entire application ecosystems.
This overflow leads the ActiveMQ broker to miscalculate the total length of the message, causing it to misinterpret a single payload as multiple MQTT control packets. This results in unpredictable broker behavior when interacting with non-compliant clients.
To exploit this weakness, an attacker must first complete authentication and establish a secure connection with the server. Once connected, they can send manipulated packets to disrupt the system.
This vulnerability violates the official MQTT v3.1.1 specification, which limits the remaining length field to a maximum of four bytes.
It is noteworthy that brokers are only at risk if they have MQTT transport connectors enabled. Systems not processing MQTT traffic are not affected by this specific vulnerability.
Impacted Systems and Remediation Steps
The Apache Software Foundation has issued emergency security updates to address this packet validation flaw.
The vulnerability affects certain versions of the Apache ActiveMQ core application, the All Module, and the MQTT Module.
Specifically, it affects any version older than 5.19.2, the 6.0.0 series up to 6.1.8, and version 6.2.0.
System administrators should immediately audit their environments to verify if they are running these outdated versions.
Users are urged to upgrade their ActiveMQ deployments to one of the official patched versions:
Version 5.19.2 Version 6.1.9 Version 6.2.1
Installing these updates will fix the length validation process, preventing the integer overflow and ensuring safe packet processing.
If immediate patching is not feasible, administrators can temporarily mitigate risk by disabling MQTT transport connectors, provided their operations do not require the protocol.
Based on reporting by GBHackers.