Integer Overflow Flaw in Apache ActiveMQ Exposes MQTT Brokers to DoS

Apache has released a security update for ActiveMQ addressing CVE-2025-66168, an integer overflow in the MQTT transport connector's Remaining Length decoding that can allow authenticated attackers to cause broker desynchronization or denial-of-service by sending malformed MQTT packets; the flaw (CWE-190) affects brokers with MQTT transport connectors enabled (OpenWire, AMQP, or STOMP-only setups are not impacted) and patches are available across three major release branches.