Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Priority MEDIUM 42CWE-789Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 5 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-789.
Summary
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.09114 95th percentileScored 2026-11-07
Fix Partial Apache ActiveMQ (Apache Software Foundation): 6.1.6, 5.18.7, 5.17.7 +1org.apache.activemq:activemq-openwire-legacy (Maven): 5.16.8, 5.17.7, 5.18.7 +1+1 more productRed Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ActiveMQ | 6.0.0 to before 6.1.6; 5.18.0 to before 5.18.7; 5.17.0 to before 5.17.7; 5.16.0 to before 5.16.8 | 6.1.6, 5.18.7, 5.17.7, 5.16.8 | Patch available | CNA |
| — | org.apache.activemq:activemq-openwire-legacy (Maven) | before 5.16.8 | 5.16.8 | Patch available | GHSA-whxr-3p84-rf3c |
| — | org.apache.activemq:activemq-client (Maven) | before 5.16.8 | 5.16.8 | Patch available | GHSA-whxr-3p84-rf3c |
| — | org.apache.activemq:activemq-openwire-legacy (Maven) | 5.17.0 to before 5.17.7 | 5.17.7 | Patch available | GHSA-whxr-3p84-rf3c |
| — | org.apache.activemq:activemq-openwire-legacy (Maven) | 5.18.0 to before 5.18.7 | 5.18.7 | Patch available | GHSA-whxr-3p84-rf3c |
| — | org.apache.activemq:activemq-openwire-legacy (Maven) | 6.0.0 to before 6.1.6 | 6.1.6 | Patch available | GHSA-whxr-3p84-rf3c |
| — | org.apache.activemq:activemq-client (Maven) | 5.17.0 to before 5.17.7 | 5.17.7 | Patch available | GHSA-whxr-3p84-rf3c |
| — | org.apache.activemq:activemq-client (Maven) | 5.18.0 to before 5.18.7 | 5.18.7 | Patch available | GHSA-whxr-3p84-rf3c |
| — | org.apache.activemq:activemq-client (Maven) | 6.0.0 to before 6.1.6 | 6.1.6 | Patch available | GHSA-whxr-3p84-rf3c |
- Apache ActiveMQ VendorApache Affected 6.0.0 to before 6.1.6; 5.18.0 to before 5.18.7; 5.17.0 to before 5.17.7; 5.16.0 to before 5.16.8 Fixed in 6.1.6, 5.18.7, 5.17.7, 5.16.8 Patch available CNA
- org.apache.activemq:activemq-openwire-legacy (Maven) Vendor— Affected before 5.16.8 Fixed in 5.16.8 Patch available GHSA-whxr-3p84-rf3c
- org.apache.activemq:activemq-client (Maven) Vendor— Affected before 5.16.8 Fixed in 5.16.8 Patch available GHSA-whxr-3p84-rf3c
- org.apache.activemq:activemq-openwire-legacy (Maven) Vendor— Affected 5.17.0 to before 5.17.7 Fixed in 5.17.7 Patch available GHSA-whxr-3p84-rf3c
- org.apache.activemq:activemq-openwire-legacy (Maven) Vendor— Affected 5.18.0 to before 5.18.7 Fixed in 5.18.7 Patch available GHSA-whxr-3p84-rf3c
- org.apache.activemq:activemq-openwire-legacy (Maven) Vendor— Affected 6.0.0 to before 6.1.6 Fixed in 6.1.6 Patch available GHSA-whxr-3p84-rf3c
- org.apache.activemq:activemq-client (Maven) Vendor— Affected 5.17.0 to before 5.17.7 Fixed in 5.17.7 Patch available GHSA-whxr-3p84-rf3c
- org.apache.activemq:activemq-client (Maven) Vendor— Affected 5.18.0 to before 5.18.7 Fixed in 5.18.7 Patch available GHSA-whxr-3p84-rf3c
- org.apache.activemq:activemq-client (Maven) Vendor— Affected 6.0.0 to before 6.1.6 Fixed in 6.1.6 Patch available GHSA-whxr-3p84-rf3c
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* | 5.16.0 to before 5.16.8; 5.17.0 to before 5.17.7; 5.18.0 to before 5.18.7; 6.0.0 to before 6.1.6 | Vulnerable | Apache |
- cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions 5.16.0 to before 5.16.8; 5.17.0 to before 5.17.7; 5.18.0 to before 5.18.7; 6.0.0 to before 6.1.6 Vulnerable ·Apache
Remediation
- Fix · CNA Apache ActiveMQ (Apache Software Foundation) Fixed in 6.1.6, 5.18.7, 5.17.7, 5.16.8
- Fix · GHSA-whxr-3p84-rf3c org.apache.activemq:activemq-openwire-legacy (Maven) Fixed in 5.16.8 Advisory →
- Fix · GHSA-whxr-3p84-rf3c org.apache.activemq:activemq-client (Maven) Fixed in 5.16.8 Advisory →
- Fix · GHSA-whxr-3p84-rf3c org.apache.activemq:activemq-openwire-legacy (Maven) Fixed in 5.17.7 Advisory →
- Fix · GHSA-whxr-3p84-rf3c org.apache.activemq:activemq-openwire-legacy (Maven) Fixed in 5.18.7 Advisory →
- Fix · GHSA-whxr-3p84-rf3c org.apache.activemq:activemq-openwire-legacy (Maven) Fixed in 6.1.6 Advisory →
- Fix · GHSA-whxr-3p84-rf3c org.apache.activemq:activemq-client (Maven) Fixed in 5.17.7 Advisory →
- Fix · GHSA-whxr-3p84-rf3c org.apache.activemq:activemq-client (Maven) Fixed in 5.18.7 Advisory →
- Fix · GHSA-whxr-3p84-rf3c org.apache.activemq:activemq-client (Maven) Fixed in 6.1.6 Advisory →
Red Hat 1 advisory
- RHSA-2025:17567 Released 2025-10-08 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.2 release and security update
- Red Hat AMQ Broker 7.13.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Clients 2 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7.13.2 | Fixed | RHSA-2025:17567 |
Not affected: 4 products
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27533
- 2026-10-03 Alias added: GHSA-whxr-3p84-rf3c
- 2026-10-04 EPSS moved to the 95th–99th percentile
References
Advisory 3
More Apache Activemq vulnerabilities
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-27533 · CVE Program
- CVE-2025-27533 · NVD
- FIRST EPSS
- GHSA-whxr-3p84-rf3c · GitHub Advisory Database · CC BY 4.0
- CVE-2025-27533 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences