PT-2025-42438 · Apache · Apache Activemq Nms Amqp Client

Published 2025-10-16 · Updated 2026-06-01 · CVE-2025-54539

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ NMS AMQP versions prior to 2.4.0

Description A deserialization of untrusted data issue exists in the Apache ActiveMQ NMS AMQP Client. Malicious servers can exploit unbounded deserialization logic to craft responses that may lead to arbitrary code execution on the client side when the client establishes connections to untrusted AMQP servers. Although a mechanism to restrict deserialization via allow/deny lists was introduced in version 2.1.0, this protection can be bypassed under certain conditions.

Recommendations Upgrade to version 2.4.0 or later. Migrate away from .NET binary serialization as a long-term hardening strategy.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-13133

CVE-2025-54539

GHSA-4MJW-XR5X-PRPC

Affected Products

Apache Activemq Nms Amqp Client

References · 23

• https://osv.dev/vulnerability/GHSA-4mjw-xr5x-prpc · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13133 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-54539 · Security Note
• https://lists.apache.org/thread/9k684j07ljrshy3hxwhj5m0xjmkz1g2n · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54539 · Vendor Advisory
• https://github.com/apache/activemq-nms-amqp · Note
• https://t.me/proxy_bar/3399 · Telegram Post
• https://twitter.com/CCBalert/status/1979198039056064700 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o91x4z/resumen_diario_de_vulnerabilidades_17102025 · Reddit Post
• http://openwall.com/lists/oss-security/2025/10/15/3 · Note
• https://twitter.com/cracbot/status/1980589933719912878 · Twitter Post
• https://twitter.com/CVEnew/status/1978926625258353003 · Twitter Post
• https://twitter.com/PurpleOps_io/status/1978838862118928610 · Twitter Post
• https://twitter.com/Dinosn/status/2056788872525177225 · Twitter Post
• https://twitter.com/fridaysecurity/status/1978643910457987114 · Twitter Post