CVE-2025-54539
BaseFortify
Publication date: 2025-10-16
Last updated on: 2025-11-04
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | activemq_nms_amqp | to 2.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Deserialization of Untrusted Data issue in the Apache ActiveMQ NMS AMQP Client. When the client establishes connections to untrusted AMQP servers, malicious servers can exploit the client's unbounded deserialization logic to craft responses that may lead to arbitrary code execution on the client side. Although some protections were introduced in version 2.1.0, they can be bypassed under certain conditions.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow a malicious AMQP server to execute arbitrary code on the client machine running the Apache ActiveMQ NMS AMQP Client. This could lead to unauthorized actions, data compromise, or system takeover.
What immediate steps should I take to mitigate this vulnerability?
Users are strongly encouraged to upgrade to Apache ActiveMQ NMS AMQP Client version 2.4.0 or later, which resolves the issue. Additionally, projects depending on NMS-AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy.