Read the docs
TI-2025-21330 Aliases CVE-2025-29953GHSA-9g64-r942-fvmp

Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass

Priority MEDIUM 53CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed. The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether. Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02091 81st percentileScored 2026-11-07
Fix Fixed Apache ActiveMQ NMS OpenWire Client (Apache Software Foundation): 2.1.1Apache.NMS.ActiveMQ (NuGet): 2.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache ActiveMQ NMS OpenWire Clientbefore 2.1.12.1.1Patch availableCNA
—Apache.NMS.ActiveMQ (NuGet)before 2.1.12.1.1Patch availableGHSA-9g64-r942-fvmp
  • Apache ActiveMQ NMS OpenWire Client VendorApache Affected before 2.1.1 Fixed in 2.1.1 Patch available CNA
  • Apache.NMS.ActiveMQ (NuGet) Vendor— Affected before 2.1.1 Fixed in 2.1.1 Patch available GHSA-9g64-r942-fvmp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq_nms_openwire:*:*:*:*:*:*:*:*before 2.1.1VulnerableApache
  • cpe:2.3:a:apache:activemq_nms_openwire:*:*:*:*:*:*:*:* Versions before 2.1.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache ActiveMQ NMS OpenWire Client (Apache Software Foundation) Fixed in 2.1.1
  • Fix · GHSA-9g64-r942-fvmp Apache.NMS.ActiveMQ (NuGet) Fixed in 2.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-29953
  2. 2026-10-03 Alias added: GHSA-9g64-r942-fvmp

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences