CVE-2025-29953 json
Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass
published 2025-04-18 18 mo ago modified 2026-06-17 4 mo ago also GHSA-9g64-r942-fvmp , EUVD-2025-11871
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client.
This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed.
The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether.
Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future.
Patch / fix
- nuget Apache.NMS.ActiveMQ 2.1.1
- Apache Software Foundation Apache ActiveMQ NMS OpenWire Client 2.1.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
2.09% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Apache.NMS.ActiveMQ | <2.1.1 |
2.1.1 |
Affected products
- Apache Software Foundation Apache ActiveMQ NMS OpenWire Client
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/apache/activemq-nms-openwire/commit/8944c41
web
-
lists.apache.org
/thread/vc1sj9y3056d3kkhcvrs9fyw5w8kpmlx
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2025/04/18/3
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-29953
advisory
-
github.com
/apache/activemq-nms-openwire
package
-
issues.apache.org
/jira/browse/AMQNET-844
web
Sources
- CVE List CVE-2025-29953
- GitHub Advisory GHSA-9g64-r942-fvmp
- NVD CVE-2025-29953
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.