Every CVE Search/ Get API key

CVE-2015-5254

Improper Input Validation in Apache ActiveMQ

9.8 CriticalPublic exploitFix available

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

38.2%Down 29.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Record
CVE-2015-5254
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Record
CVE-2015-5254
Updated
2026-11-02
EUVDEUVD-2022-4933 No score

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Record
EUVD-2022-4933
Updated
2026-11-03
GitHub AdvisoriesGHSA-q9hr-3pg4-3jp4 9.8

Improper Input Validation in Apache ActiveMQ

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Record
GHSA-q9hr-3pg4-3jp4
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 9.8

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Record
CVE-2015-5254
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2015-5254 9.8

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Record
DEBIAN-CVE-2015-5254
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-q9hr-3pg4-3jp4 9.8

Improper Input Validation in Apache ActiveMQ

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Record
GHSA-q9hr-3pg4-3jp4
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVUBUNTU-CVE-2015-5254 9.8

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Record
UBUNTU-CVE-2015-5254
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.activemq:activemq-client
Maven
 5.0.0 up to 5.11.3
5.11.3
org.apache.activemq:activemq-client
Maven
 5.12.0 up to 5.12.2
5.12.2
activemq
Debian:12
 before 5.13.2+dfsg-1
5.13.2+dfsg-1
activemq
Debian:13
 before 5.13.2+dfsg-1
5.13.2+dfsg-1
activemq
Debian:7
 before 5.6.0+dfsg-1+deb7u2, plus listed versions
5.6.0+dfsg-15.6.0+dfsg-1+deb7u1
5.6.0+dfsg-1+deb7u2
activemq
Debian:8
 before 5.6.0+dfsg1-4+deb8u2, plus listed versions
5.6.0+dfsg1-45.6.0+dfsg1-4+deb8u1
5.6.0+dfsg1-4+deb8u2
org.apache.activemq:activemq-client
Maven
 5.0.0 up to 5.11.3, plus listed versions
5.10.05.10.15.10.25.11.05.11.1
Show 4 moreShow less
5.11.25.8.05.9.05.9.1
5.11.3
org.apache.activemq:activemq-client
Maven
 5.12.0 up to 5.12.2, plus listed versions
5.12.1
5.12.2
rhc
Red Hat:openshift:2.0::el6
 before 0:1.38.6.1-1.el6op
0:1.38.6.1-1.el6op
activemq
Red Hat:openshift:2.0::el6
 before 0:5.9.0-6.redhat.611454.el6op
0:5.9.0-6.redhat.611454.el6op
Show 31 moreShow less
Affected packages
PackageAffectedFixed
activemq-client
Red Hat:openshift:2.0::el6
 before 0:5.9.0-6.redhat.611454.el6op
0:5.9.0-6.redhat.611454.el6op
openshift-enterprise-release
Red Hat:openshift:2.0::el6
 before 0:2.2.9-1.el6op
0:2.2.9-1.el6op
openshift-enterprise-upgrade
Red Hat:openshift:2.0::el6
 before 0:2.2.9-1.el6op
0:2.2.9-1.el6op
openshift-enterprise-upgrade-broker
Red Hat:openshift:2.0::el6
 before 0:2.2.9-1.el6op
0:2.2.9-1.el6op
openshift-enterprise-yum-validator
Red Hat:openshift:2.0::el6
 before 0:2.2.9-1.el6op
0:2.2.9-1.el6op
openshift-origin-broker-util
Red Hat:openshift:2.0::el6
 before 0:1.37.5.3-1.el6op
0:1.37.5.3-1.el6op
rubygem-openshift-origin-common
Red Hat:openshift:2.0::el6
 before 0:1.29.5.2-1.el6op
0:1.29.5.2-1.el6op
rubygem-openshift-origin-console
Red Hat:openshift:2.0::el6
 before 0:1.35.5.1-1.el6op
0:1.35.5.1-1.el6op
rubygem-openshift-origin-controller
Red Hat:openshift:2.0::el6
 before 0:1.38.5.1-1.el6op
0:1.38.5.1-1.el6op
jenkins
Red Hat:openshift:2.0::el6
 before 0:1.625.3-1.el6op
0:1.625.3-1.el6op
openshift-enterprise-upgrade-node
Red Hat:openshift:2.0::el6
 before 0:2.2.9-1.el6op
0:2.2.9-1.el6op
openshift-origin-cartridge-cron
Red Hat:openshift:2.0::el6
 before 0:1.25.2.1-1.el6op
0:1.25.2.1-1.el6op
openshift-origin-cartridge-haproxy
Red Hat:openshift:2.0::el6
 before 0:1.31.5.1-1.el6op
0:1.31.5.1-1.el6op
openshift-origin-cartridge-mysql
Red Hat:openshift:2.0::el6
 before 0:1.31.2.1-1.el6op
0:1.31.2.1-1.el6op
openshift-origin-cartridge-php
Red Hat:openshift:2.0::el6
 before 0:1.35.3.1-1.el6op
0:1.35.3.1-1.el6op
openshift-origin-cartridge-python
Red Hat:openshift:2.0::el6
 before 0:1.34.2.1-1.el6op
0:1.34.2.1-1.el6op
openshift-origin-msg-node-mcollective
Red Hat:openshift:2.0::el6
 before 0:1.30.2.1-1.el6op
0:1.30.2.1-1.el6op
openshift-origin-node-proxy
Red Hat:openshift:2.0::el6
 before 0:1.26.2.1-1.el6op
0:1.26.2.1-1.el6op
openshift-origin-node-util
Red Hat:openshift:2.0::el6
 before 0:1.38.6.2-1.el6op
0:1.38.6.2-1.el6op
php
Red Hat:openshift:2.0::el6
 before 0:5.3.3-46.el6_7.1
0:5.3.3-46.el6_7.1
php-bcmath
Red Hat:openshift:2.0::el6
 before 0:5.3.3-46.el6_7.1
0:5.3.3-46.el6_7.1
php-debuginfo
Red Hat:openshift:2.0::el6
 before 0:5.3.3-46.el6_7.1
0:5.3.3-46.el6_7.1
php-devel
Red Hat:openshift:2.0::el6
 before 0:5.3.3-46.el6_7.1
0:5.3.3-46.el6_7.1
php-fpm
Red Hat:openshift:2.0::el6
 before 0:5.3.3-46.el6_7.1
0:5.3.3-46.el6_7.1
php-imap
Red Hat:openshift:2.0::el6
 before 0:5.3.3-46.el6_7.1
0:5.3.3-46.el6_7.1
php-intl
Red Hat:openshift:2.0::el6
 before 0:5.3.3-46.el6_7.1
0:5.3.3-46.el6_7.1
php-mbstring
Red Hat:openshift:2.0::el6
 before 0:5.3.3-46.el6_7.1
0:5.3.3-46.el6_7.1
php-process
Red Hat:openshift:2.0::el6
 before 0:5.3.3-46.el6_7.1
0:5.3.3-46.el6_7.1
rubygem-openshift-origin-frontend-apache-vhost
Red Hat:openshift:2.0::el6
 before 0:0.13.2.1-1.el6op
0:0.13.2.1-1.el6op
rubygem-openshift-origin-node
Red Hat:openshift:2.0::el6
 before 0:1.38.5.3-1.el6op
0:1.38.5.3-1.el6op
activemq
Ubuntu:14.04:LTS
 before 5.6.0+dfsg-1+deb7u2build0.14.04.1, plus listed versions
5.6.0+dfsg-15.6.0+dfsg-1+deb7u1build0.14.04.1
5.6.0+dfsg-1+deb7u2build0.14.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubCatherines77/ActiveMQ-EXPtools2026-04-20
PoC in GitHubMa1Dong/ActiveMQ_CVE-2015-52542020-08-03
PoC in GitHubguigui237/Exploitation-de-la-vuln-rabilit-CVE-2015-5254-2024-11-05
PoC in GitHubjas502n/CVE-2015-52542019-08-30
PoC in GitHubradsih/activemq-cve-lab2026-08-31

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5254 is a critical vulnerability (CVSS 9.8) in Apache Activemq, published January 8, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 38.2%, the 98th percentile. Fixed in org.apache.activemq:activemq-client 5.11.3.

References

Show 108 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open