Apache ActiveMQ Allow Attackers to Trigger DoS Attacks With Malformed Packets

A medium-severity vulnerability (CVE-2025-66168, CVSS 5.4) in Apache ActiveMQ's MQTT module can allow authenticated attackers to trigger a denial-of-service by sending malformed MQTT packets that exploit an integer overflow in the remaining-length decoding; affected versions include all releases before 5.19.2, 6.0.0–6.1.8, and 6.2.0 — administrators should upgrade to 5.19.2, 6.1.9, or 6.2.1 or temporarily disable the MQTT transport connector as a mitigation.