Deserialization Vulnerability in Apache ActiveMQ NMS AMQP Client
CVE-2025-54539

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache ActiveMQ Nms AMQp Client
Vendor
CVE Published:
16 October 2025

What is CVE-2025-54539?

A vulnerability exists in the Apache ActiveMQ NMS AMQP Client that allows for untrusted data deserialization when connecting to potentially malicious AMQP servers. This issue exposes all versions prior to 2.4.0 to risks of arbitrary code execution via crafted server responses. Despite the introduction of a protective mechanism in version 2.1.0, certain conditions allow this protection to be circumvented. Users are advised to upgrade to version 2.4.0 or higher and reconsider the use of .NET binary serialization as part of their security strategy.

Affected Version(s)

Apache ActiveMQ NMS AMQP Client 0 <= 2.3.0

References

https://lists.apache.org/thread/9k684j07ljrshy3hxwhj5m0xj...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Security Research Team @ Endor Labs
JSON
.
CVE-2025-54539 : Deserialization Vulnerability in Apache ActiveMQ NMS AMQP Client