CVE-2025-27533: fallo de gravedad media en Apache ActiveMQ
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Publicada el · Actualizada el
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.9epss 9.0%
de la publicación al arma2 días
Publicada en NVD7 may
1ª PoC+2d
probabilidad de explotación
9.0%top 5% de las CVE
explotación observada
noninguna fuente lo reporta
2 exploit(s) público(s)
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red
Productos afectados
Apache Software Foundation · Apache ActiveMQPoCs públicas encontradas — 2
exploitdbwww.exploit-db.com/exploits/52288no verificadogithubgithub.com/absholi7ly/CVE-2025-27533-Exploit-for-Apache-ActiveMQ★ 8⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Apache ActiveMQ
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-46604CRITICALApache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackEPSS 99.9%KEVCVE-2026-34197HIGHApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansEPSS 15.5%KEVCVE-2022-41678—Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCEEPSS 85.8%CVE-2018-8006—CVE-2018-8006EPSS 55.4%CVE-2017-15709—CVE-2017-15709EPSS 22.8%CVE-2021-26117—ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bindEPSS 11.3%