Deserialization Vulnerability in Apache ActiveMQ NMS AMQP Client
CVE-2025-54539

Currently unrated

Key Information:

Vendor

Apache
Status
Apache ActiveMQ Nms AMQp Client
Vendor
CVE Published:
16 October 2025

What is CVE-2025-54539?

A vulnerability exists in the Apache ActiveMQ NMS AMQP Client that allows for untrusted data deserialization when connecting to potentially malicious AMQP servers. This issue exposes all versions prior to 2.4.0 to risks of arbitrary code execution via crafted server responses. Despite the introduction of a protective mechanism in version 2.1.0, certain conditions allow this protection to be circumvented. Users are advised to upgrade to version 2.4.0 or higher and reconsider the use of .NET binary serialization as part of their security strategy.

Affected Version(s)

Apache ActiveMQ NMS AMQP Client 0 <= 2.3.0

References

https://lists.apache.org/thread/9k684j07ljrshy3hxwhj5m0xj...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Security Research Team @ Endor Labs
JSON
.
CVE-2025-54539 : Deserialization Vulnerability in Apache ActiveMQ NMS AMQP Client