This vulnerability is an integer overflow or wraparound issue (CWE-190) in Apache ActiveMQ affecting versions 6.0.0 before 6.2.4, including Apache ActiveMQ All and MQTT variants. The root cause is a missed application of a fix for a related vulnerability (CVE-2025-66168) in the 6.x branch, which was only applied to the 5.19.x branch starting with 5.19.2. The flaw can lead to denial of service conditions due to improper validation of MQTT control packet remaining length fields. The vendor recommends upgrading to version 6.2.4 or to 5.19.2 or later to address the issue. The CVSS v3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability can cause denial of service (availability impact) in affected Apache ActiveMQ versions due to integer overflow or wraparound in MQTT packet processing. There is no impact on confidentiality or integrity. No known exploits have been reported in the wild.

Users should upgrade affected Apache ActiveMQ installations to version 6.2.4 or to a 5.19.x version starting with 5.19.2 or later, as these versions include the fix for this vulnerability. Patch status is confirmed by the vendor advisory recommending these versions. No other mitigation or temporary workaround is indicated.