CVE-2025-27533mediumCWE-789

CVE-2025-27533: medium-severity vulnerability in Apache ActiveMQ

Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

Published · Updated

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 9.0%
from disclosure to weapon2 days
Published on NVDMay 7
1st PoC+2d
exploitation probability
9.0%top 5% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red
Affected products
Apache Software Foundation · Apache ActiveMQ
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/52288unverifiedgithubgithub.com/absholi7ly/CVE-2025-27533-Exploit-for-Apache-ActiveMQ★ 8
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache ActiveMQ

In the same product, most dangerous first.

CVE-2023-46604CRITICALApache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackEPSS 99.9%KEVCVE-2026-34197HIGHApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansEPSS 15.5%KEVCVE-2022-41678—Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCEEPSS 85.8%CVE-2018-8006—CVE-2018-8006EPSS 55.4%CVE-2017-15709—CVE-2017-15709EPSS 22.8%CVE-2021-26117—ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bindEPSS 11.3%
References
https://lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hghttps://lists.debian.org/debian-lts-announce/2025/06/msg00020.htmlhttp://www.openwall.com/lists/oss-security/2025/05/06/1