CVE-2025-29953

Description

Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed. The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether. Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future.

Reserved 2025-03-12 | Published 2025-04-18 | Updated 2025-04-23 | Assigner apache

Problem types

CWE-502 Deserialization of Untrusted Data

Product status

Default status
unaffected

Any version before 2.1.1
affected

Credits

g7shot working with Trend Zero Day Initiative finder

References

lists.apache.org/thread/vc1sj9y3056d3kkhcvrs9fyw5w8kpmlx vendor-advisory

cve.org (CVE-2025-29953)

nvd.nist.gov (CVE-2025-29953)

Download JSON