CVE-2025-27533
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
- Record
CVE-2025-27533- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red - Weakness
- CWE-789
- Updated
- 2026-11-02
EUVDEUVD-2025-13714
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
- Record
EUVD-2025-13714- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-whxr-3p84-rf3c
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
- Record
GHSA-whxr-3p84-rf3c- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-02
NVD
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
- Record
CVE-2025-27533- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Red - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-02
OSV
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
- Record
CVE-2025-27533- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red - Weakness
- CWE-789
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-27533
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers.
- Record
DEBIAN-CVE-2025-27533- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-whxr-3p84-rf3c
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
- Record
GHSA-whxr-3p84-rf3c- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-02
OSVOESA-2025-1507
activemq security update
The most popular and powerful open source messaging and Integration Patterns server.
Security Fix(es):
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.(CVE-2025-27533)
- Record
OESA-2025-1507- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-27533
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers.
- Record
UBUNTU-CVE-2025-27533- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-activemq-2025-27533 No score
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
- Record
BIT-activemq-2025-27533- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-27533 No score
CVE-2025-27533 in io.root.org.apache.activemq:activemq-openwire-legacy - Patched by Root
Root has patched CVE-2025-27533 in the io.root.org.apache.activemq:activemq-openwire-legacy package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-27533- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.activemq:activemq-openwire-legacyMaven |
before 5.16.8 | 5.16.8 |
org.apache.activemq:activemq-clientMaven |
before 5.16.8 | 5.16.8 |
org.apache.activemq:activemq-openwire-legacyMaven |
5.17.0 up to 5.17.7 | 5.17.7 |
org.apache.activemq:activemq-openwire-legacyMaven |
5.18.0 up to 5.18.7 | 5.18.7 |
org.apache.activemq:activemq-openwire-legacyMaven |
6.0.0 up to 6.1.6 | 6.1.6 |
org.apache.activemq:activemq-clientMaven |
5.17.0 up to 5.17.7 | 5.17.7 |
org.apache.activemq:activemq-clientMaven |
5.18.0 up to 5.18.7 | 5.18.7 |
org.apache.activemq:activemq-clientMaven |
6.0.0 up to 6.1.6 | 6.1.6 |
activemqBitnami |
5.16.0 up to 5.16.8, 5.17.0 up to 5.17.7, 5.18.0 up to 5.18.7, 6.0.0 up to 6.1.6 | 5.16.85.17.75.18.76.1.6 |
activemqDebian:12 |
All versions, plus listed versions 5.17.2+dfsg-25.17.2+dfsg-2+deb12u15.17.6+dfsg-15.17.6+dfsg-2 |
None known |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
activemqDebian:13 |
before 5.17.6+dfsg-2 | 5.17.6+dfsg-2 |
activemqDebian:11 |
before 5.16.1-1+deb11u2, plus listed versions 5.16.1-15.16.1-1+deb11u1 |
5.16.1-1+deb11u2 |
org.apache.activemq:activemq-openwire-legacyMaven |
before 5.16.8, plus listed versions 5.10.05.10.15.10.25.11.05.11.1 Show 45 moreShow less5.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.14.05.14.15.14.25.14.35.14.45.14.55.15.05.15.15.15.105.15.115.15.125.15.135.15.145.15.155.15.165.15.25.15.35.15.45.15.55.15.65.15.75.15.85.15.95.16.05.16.15.16.25.16.35.16.45.16.55.16.65.16.75.8.0 |
5.16.8 |
org.apache.activemq:activemq-clientMaven |
before 5.16.8, plus listed versions 5.10.05.10.15.10.25.11.05.11.1 Show 45 moreShow less5.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.14.05.14.15.14.25.14.35.14.45.14.55.15.05.15.15.15.105.15.115.15.125.15.135.15.145.15.155.15.165.15.25.15.35.15.45.15.55.15.65.15.75.15.85.15.95.16.05.16.15.16.25.16.35.16.45.16.55.16.65.16.75.8.0 |
5.16.8 |
org.apache.activemq:activemq-openwire-legacyMaven |
5.17.0 up to 5.17.7, plus listed versions 5.17.15.17.25.17.35.17.45.17.55.17.6 |
5.17.7 |
org.apache.activemq:activemq-openwire-legacyMaven |
5.18.0 up to 5.18.7, plus listed versions 5.18.15.18.25.18.35.18.45.18.55.18.6 |
5.18.7 |
org.apache.activemq:activemq-openwire-legacyMaven |
6.0.0 up to 6.1.6, plus listed versions 6.0.16.1.06.1.16.1.26.1.36.1.46.1.5 |
6.1.6 |
org.apache.activemq:activemq-clientMaven |
5.17.0 up to 5.17.7, plus listed versions 5.17.15.17.25.17.35.17.45.17.55.17.6 |
5.17.7 |
org.apache.activemq:activemq-clientMaven |
5.18.0 up to 5.18.7, plus listed versions 5.18.15.18.25.18.35.18.45.18.55.18.6 |
5.18.7 |
org.apache.activemq:activemq-clientMaven |
6.0.0 up to 6.1.6, plus listed versions 6.0.16.1.06.1.16.1.26.1.36.1.46.1.5 |
6.1.6 |
activemqopenEuler:22.03-LTS-SP4 |
before 5.16.8-1.oe2203sp4 | 5.16.8-1.oe2203sp4 |
activemqopenEuler:24.03-LTS |
before 5.16.8-1.oe2403sp1 | 5.16.8-1.oe2403sp1 |
activemqopenEuler:24.03-LTS-SP1 |
before 5.16.8-1.oe2403sp1 | 5.16.8-1.oe2403sp1 |
activemqopenEuler:20.03-LTS-SP4 |
before 5.16.8-1.oe2003sp4 | 5.16.8-1.oe2003sp4 |
activemqopenEuler:22.03-LTS-SP3 |
before 5.16.8-1.oe2203sp3 | 5.16.8-1.oe2203sp3 |
io.root.org.apache.activemq:activemq-openwire-legacyRoot:Maven |
before 5.18.3-root.io.4 | 5.18.3-root.io.46.1.3-root.io.26.1.3-root.io.35.18.3-root.io.86.1.3-root.io.45.18.3-root.io.95.18.3-root.io.106.1.3-root.io.55.18.3-root.io.116.1.3-root.io.66.1.3-root.io.75.18.3-root.io.126.1.3-root.io.8 |
io.root.org.apache.activemq:activemq-clientRoot:Maven |
before 5.18.3-root.io.3 | 5.18.3-root.io.36.1.3-root.io.25.18.3-root.io.86.1.3-root.io.45.18.3-root.io.95.18.3-root.io.106.1.3-root.io.55.18.3-root.io.116.1.3-root.io.66.1.3-root.io.75.18.3-root.io.126.1.3-root.io.8 |
org.apache.activemq:activemq-clientRoot:Maven |
before 5.18.3-aikido.10 | 5.18.3-aikido.106.1.3-aikido.55.18.3-aikido.116.1.3-aikido.66.1.3-aikido.75.18.3-aikido.126.1.3-aikido.8 |
org.apache.activemq:activemq-openwire-legacyRoot:Maven |
before 5.18.3-aikido.10 | 5.18.3-aikido.106.1.3-aikido.55.18.3-aikido.116.1.3-aikido.65.18.3-aikido.126.1.3-aikido.76.1.3-aikido.8 |
activemqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-25.13.2+dfsg-2ubuntu0.1~esm1 |
None known |
activemqUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.14.5-35.15.2-25.15.3-25.15.8-2~18.045.15.8-2~18.04.1~esm1 |
None known |
activemqUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.15.10-15.15.11-15.15.11-1ubuntu0.1~esm1 |
None known |
activemqUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.16.1-15.16.1-1ubuntu0.1~esm15.16.1-1ubuntu0.1 |
None known |
activemqUbuntu:24.04:LTS |
All versions, plus listed versions 5.17.2+dfsg-25.17.6+dfsg-1 |
None known |
activemqUbuntu:25.10 |
All versions, plus listed versions 5.17.6+dfsg-15.17.6+dfsg-2 |
None known |
activemqUbuntu:26.10 |
All versions, plus listed versions 5.17.6+dfsg-25.17.6+dfsg-2ubuntu1 |
None known |
activemqUbuntu:26.04:LTS |
All versions, plus listed versions 5.17.6+dfsg-2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache ActiveMQ 6.1.6 - Denial of Service (DOS) | 2025-05-09 |
| PoC in GitHub | absholi7ly/CVE-2025-27533-Exploit-for-Apache-ActiveMQ | 2025-05-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-27533 is a medium vulnerability (CVSS 6.9) in Apache Activemq, published May 7, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.11%, the 95th percentile. Fixed in org.apache.activemq:activemq-openwire-legacy 5.16.8.
References
lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hg
openwall.com/lists/oss-security/2025/05/06/1
lists.debian.org/debian-lts-announce/2025/06/msg00020.html
nvd.nist.gov/vuln/detail/CVE-2025-27533
github.com/apache/activemq/commit/fc4372b9f0f72b8b5eed917f0019c5cea45c5d06
issues.apache.org/jira/browse/AMQ-6596
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2025-27533
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1507
ubuntu.com/security/CVE-2025-27533
cve.org/CVERecord?id=CVE-2025-27533
Left out here: 4 versions. The JSON record has them.