{"id":"CVE-2025-54539","sourceIdentifier":"security@apache.org","published":"2025-10-16T09:15:34.680","lastModified":"2026-10-09T10:10:00.193","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client.\n\nThis issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic present in the client to craft responses that may lead to arbitrary code execution on the client side.\n\nAlthough version 2.1.0 introduced a mechanism to restrict deserialization via allow/deny lists, the protection was found to be bypassable under certain conditions.\n\nIn line with Microsoft’s deprecation of binary serialization in .NET 9, the project is evaluating the removal of .NET binary serialization support from the NMS API entirely in future releases.\n\nMitigation and Recommendations:\nUsers are strongly encouraged to upgrade to version 2.4.0 or later, which resolves the issue. Additionally, projects depending on NMS-AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy."},{"lang":"es","value":"Una vulnerabilidad de deserialización de datos no confiables existe en el cliente Apache ActiveMQ NMS AMQP.\n\nEste problema afecta a todas las versiones de Apache ActiveMQ NMS AMQP hasta la 2.3.0 inclusive, al establecer conexiones con servidores AMQP no confiables. Servidores maliciosos podrían explotar la lógica de deserialización ilimitada presente en el cliente para crear respuestas que podrían conducir a la ejecución de código arbitrario en el lado del cliente.\n\nAunque la versión 2.1.0 introdujo un mecanismo para restringir la deserialización mediante listas de permitidos/denegados, se descubrió que la protección podía ser eludida bajo ciertas condiciones.\n\nEn línea con la deprecación de la serialización binaria por parte de Microsoft en .NET 9, el proyecto está evaluando la eliminación completa del soporte de serialización binaria de .NET de la API de NMS en futuras versiones.\n\nMitigación y Recomendaciones:\nSe recomienda encarecidamente a los usuarios que actualicen a la versión 2.4.0 o posterior, lo que resuelve el problema. Además, los proyectos que dependen de NMS-AMQP deberían migrar de la serialización binaria de .NET como parte de una estrategia de endurecimiento a largo plazo."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache ActiveMQ NMS AMQP Client","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-17T03:55:34.133349Z","id":"CVE-2025-54539","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:activemq_nms_amqp:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.0","matchCriteriaId":"933FFB4D-689A-4834-8733-EE9896BFCBD5"}]}]}],"references":[{"url":"https://lists.apache.org/thread/9k684j07ljrshy3hxwhj5m0xjmkz1g2n","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/15/3","source":"af854a3a-2127-422b-91ae-364da2661108"}]}