Apache ActiveMQ versions before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0 improperly validate the MQTT Remaining Length field, leading to an integer overflow during decoding of malformed MQTT packets. This overflow causes incorrect computation of the Remaining Length, resulting in misinterpretation of the payload as multiple MQTT control packets. This behavior violates the MQTT v3.1.1 specification and may cause unexpected broker behavior when interacting with non-compliant MQTT clients. The vulnerability manifests on established connections post-authentication and only affects brokers with MQTT transport connectors enabled.

The integer overflow can cause the broker to misinterpret MQTT payloads, potentially leading to unexpected behavior when handling MQTT traffic from non-compliant clients. The impact is limited to confidentiality and integrity with low-level consequences (CVSS 5.4), and there is no indication of availability impact or known exploits in the wild. Brokers not using MQTT transport connectors are not affected.

A fix is available. Users should upgrade Apache ActiveMQ to version 5.19.2, 6.1.9, or 6.2.1 or later to address this vulnerability. The advisory notes that users of 6.x should upgrade to 6.2.4 or later as the fix was missed in earlier 6.x releases. No additional mitigation steps are indicated beyond applying the official patches.