Vulnerability · Published May 7, 2025 · Assigned by apache
CVE-2025-27533Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Medium 6.9
In plain English
A medium-severity security flaw in Apache ActiveMQ from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.0% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | activemq | no fix listed | DEBIAN-CVE-2025-27533 |
| Debian:13 | activemq | 5.17.6+dfsg-2 | DEBIAN-CVE-2025-27533 |
| Maven | org.apache.activemq:activemq-client | 5.18.7 | GHSA-whxr-3p84-rf3c |
| Maven | org.apache.activemq:activemq-client | 6.1.6 | GHSA-whxr-3p84-rf3c |
| Maven | org.apache.activemq:activemq-client | 5.16.8 | GHSA-whxr-3p84-rf3c |
| Maven | org.apache.activemq:activemq-client | 5.17.7 | GHSA-whxr-3p84-rf3c |
| Maven | org.apache.activemq:activemq-openwire-legacy | 5.16.8 | GHSA-whxr-3p84-rf3c |
| Maven | org.apache.activemq:activemq-openwire-legacy | 5.17.7 | GHSA-whxr-3p84-rf3c |
| Maven | org.apache.activemq:activemq-openwire-legacy | 5.18.7 | GHSA-whxr-3p84-rf3c |
| Maven | org.apache.activemq:activemq-openwire-legacy | 6.1.6 | GHSA-whxr-3p84-rf3c |
| Ubuntu:24.04:LTS | activemq | no fix listed | UBUNTU-CVE-2025-27533 |
| Ubuntu:25.10 | activemq | no fix listed | UBUNTU-CVE-2025-27533 |
| Ubuntu:26.04:LTS | activemq | no fix listed | UBUNTU-CVE-2025-27533 |
| Ubuntu:26.10 | activemq | no fix listed | UBUNTU-CVE-2025-27533 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | 6.0.0 – before 6.1.65.18.0 – before 5.18.75.17.0 – before 5.17.75.16.0 – before 5.16.8 |
Weakness: CWE-789 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red