CVE-2025-29953 Details
Description
Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed. The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether. Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future.
A deserialization vulnerability allowing untrusted data to be processed has been identified in Apache ActiveMQ NMS OpenWire Client versions prior to 2.1.1. When connected to untrusted servers, these servers could exploit the lack of deserialization limits to send malicious responses, potentially leading to arbitrary code execution on the client. Although version 2.1.0 introduced a allow/denylist feature to control deserialization, this could be bypassed. The .NET team has deprecated the built-in binary serialization feature starting with .NET 9, recommending a migration away from binary serialization. The ActiveMQ project is considering a similar move, potentially dropping this aspect of the NMS API altogether.
Users are advised to upgrade to Apache ActiveMQ NMS OpenWire Client version 2.1.1 or later, which addresses this vulnerability. Additionally, it is recommended to migrate away from using .NET binary serialization as a hardening measure.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2025/04/18/3 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/vc1sj9y3056d3kkhcvrs9fyw5w8kpmlx | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | CISA-ADP |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache activemq nms openwire | < 2.1.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2025 | Initial Analysis | [email protected] |
| Apr 23, 2025 | CVE Modified | CISA-ADP |
| Apr 18, 2025 | CVE Modified | CVE |
| Apr 18, 2025 | New CVE Received | [email protected] |