This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Apache ActiveMQ fixes 1 vulnerability
Apache fixes a vulnerability in ActiveMQ with versions 6.1.6, 5.19.0, 5.18.7, 5.17.7 and 5.16.8 [1][2].
An unauthenticated remote attacker can, due to insufficient buffer size validation during deserialization of OpenWire messages, carry out a DoS attack on the broker. This may affect the availability of dependent applications and services, particularly where mutual TLS (mTLS), which would restrict access to trusted clients only, is not deployed. If an immediate update to a fixed version is not possible, the existing user is advised to temporarily mitigate the risk by implementing mTLS on the vulnerable broker [1][2].
The vulnerability is present in product:
- *:Apache ActiveMQ; >=5.16.0, <5.16.8; >=5.17.0, <5.17.7; >=5.18.0, <5.18.7; >=6.0.0, <6.1.6;
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Red
More information:
- CVE-2025-27533 at cve.org, NVD
- CWE-789: Memory Allocation with Excessive Size Value at cwe.mitre.org
The vulnerability was publicly disclosed 6. 5. 2025.
Links
By CESNET, z.s.p.o. Michaela Ručková on 7. 5. 2025.