GHSA-whxr-3p84-rf3c BIT-activemq-2025-27533 CVE-2025-27533
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 8.96%
- Chance of exploitation in the next 30 days. Higher than 95.25% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-789 Memory Allocation with Excessive Size Value
- Fix
- Available
- 2 packages have a fixed version
Description
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.activemq:activemq-client | < 5.16.8 |
5.16.8 |
| org.apache.activemq:activemq-client | >= 5.17.0, < 5.17.7 |
5.17.7 |
| org.apache.activemq:activemq-client | >= 5.18.0, < 5.18.7 |
5.18.7 |
| org.apache.activemq:activemq-client | >= 6.0.0, < 6.1.6 |
6.1.6 |
| org.apache.activemq:activemq-openwire-legacy | < 5.16.8 |
5.16.8 |
| org.apache.activemq:activemq-openwire-legacy | >= 5.17.0, < 5.17.7 |
5.17.7 |
| org.apache.activemq:activemq-openwire-legacy | >= 5.18.0, < 5.18.7 |
5.18.7 |
| org.apache.activemq:activemq-openwire-legacy | >= 6.0.0, < 6.1.6 |
6.1.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.activemq:activemq-client Maven → 5.16.8
- maven
<dependency><groupId>org.apache.activemq</groupId><artifactId>activemq-client</artifactId><version>5.16.8</version></dependency>- gradle
implementation("org.apache.activemq:activemq-client:5.16.8")
org.apache.activemq:activemq-openwire-legacy Maven → 5.16.8
- maven
<dependency><groupId>org.apache.activemq</groupId><artifactId>activemq-openwire-legacy</artifactId><version>5.16.8</version></dependency>- gradle
implementation("org.apache.activemq:activemq-openwire-legacy:5.16.8")
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- High
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- High
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-789: Memory Allocation with Excessive Size Value
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
How to prevent it
- Implementation, Architecture and Design: Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
- Operation: Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-crg9-44h2-xw35 Apache ActiveMQ is vulnerable to Remote Code Execution | Critical Known exploited | Also affects org.apache.activemq:activemq-client |
| GHSA-rxqh-fc23-gxp2 Improper Input Validation in Apache ActiveMQ | Critical Known exploited | Also affects org.apache.activemq:activemq-client |
| GHSA-5568-6qcg-g7fx Apache ActiveMQ: Denial of Service via Out of Memory vulnerability | High | Also affects org.apache.activemq:activemq-client |
| GHSA-h2h4-5m64-m273 Apache ActiveMQ: Improper validation and restriction of a classpath path name | Medium | Also affects org.apache.activemq:activemq-client |
| GHSA-p358-58jj-hp65 Improper Authentication in Apache ActiveMQ | Medium | Also affects org.apache.activemq:activemq-client |
| GHSA-mfhr-3xmc-r2gg Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ | Medium | Also affects org.apache.activemq:activemq-client |
| GHSA-3wfj-vh84-732p Improper Neutralization of Special Elements used in an OS Command in Apache ActiveMQ | High | Also affects org.apache.activemq:activemq-client |
| GHSA-9cvr-8xq4-2m73 Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ | Medium | Also affects org.apache.activemq:activemq-client |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor