Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2026-11946

Опубликовано: 04 мар. 2026
Источник: fstec
CVSS3: 8.8
CVSS2: 9
EPSS Низкий

Описание

Уязвимость программных продуктов Apache ActiveMQ связана с целочисленным переполнением. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Вендор

ООО «Ред Софт»
Apache Software Foundation

Наименование ПО

РЕД ОС
Apache ActiveMQ
Apache ActiveMQ All
Apache ActiveMQ MQTT

Версия ПО

7.3 (РЕД ОС)
8.0 (РЕД ОС)
до 5.19.2 (Apache ActiveMQ)
от 6.2.0 до 6.2.1 (Apache ActiveMQ)
от 6.0.0 до 6.1.9 (Apache ActiveMQ)
до 5.19.2 (Apache ActiveMQ All)
от 6.2.0 до 6.2.1 (Apache ActiveMQ All)
от 6.0.0 до 6.1.9 (Apache ActiveMQ All)
до 5.19.2 (Apache ActiveMQ MQTT)
от 6.2.0 до 6.2.1 (Apache ActiveMQ MQTT)
от 6.0.0 до 6.1.9 (Apache ActiveMQ MQTT)

Тип ПО

Операционная система
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

ООО «Ред Софт» РЕД ОС 7.3
ООО «Ред Софт» РЕД ОС 8.0

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 9)
Высокий уровень опасности (базовая оценка CVSS 3.1 составляет 8,8)

Возможные меры по устранению уязвимости

Использование рекомендаций производителя:
https://lists.apache.org/thread/13n8mkrb2jf2y6yyhpgrkmpqcm7djyto
Для Ред ОС:
http://repo.red-soft.ru/redos/8.0/x86_64/updates/
http://repo.red-soft.ru/redos/7.3c/x86_64/updates/

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 54%
0.0078
Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Связанные уязвимости

CVSS3: 5.4
ubuntu
7 месяцев назад

WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the  following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=CVE-2026-40046 Original Report: Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted. This issue affects A...

CVSS3: 5.4
redhat
7 месяцев назад

WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the  following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=CVE-2026-40046 Original Report: Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted. This issue affects...

CVSS3: 5.4
nvd
7 месяцев назад

WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the  following for more details: https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt https://www.cve.org/CVERecord?id=CVE-2026-40046 Original Report: Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted. This issue a

CVSS3: 5.4
debian
7 месяцев назад

WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was ...

CVSS3: 8.8
redos
около 2 месяцев назад

Уязвимость apache-activemq

EPSS

Процентиль: 54%
0.0078
Низкий

8.8 High

CVSS3

9 Critical

CVSS2