CVE-2025-27533

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27533
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hg Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/05/06/1 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
History

16 Jul 2025, 14:45

Type Values Removed Values Added
CPE cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Apache
Apache activemq
References () https://lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hg - () https://lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hg - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2025/05/06/1 - () http://www.openwall.com/lists/oss-security/2025/05/06/1 - Mailing List, Third Party Advisory
Summary
  • (es) Vulnerabilidad de asignación de memoria con valor de tamaño excesivo en Apache ActiveMQ. Durante la desmarshalling de comandos OpenWire, el valor de tamaño de los búferes no se validó correctamente, lo que podría provocar una asignación excesiva de memoria y ser explotado para causar una denegación de servicio (DoS) al agotar la memoria del proceso. Esto afecta a aplicaciones y servicios que dependen de la disponibilidad del broker ActiveMQ cuando no utilizan conexiones TLS mutuas. Este problema afecta a Apache ActiveMQ: desde la versión 6.0.0 hasta la 6.1.6, desde la versión 5.18.0 hasta la 5.18.7, desde la versión 5.17.0 hasta la 5.17.7 y hasta la 5.16.8. ActiveMQ 5.19.0 no se ve afectado. Se recomienda a los usuarios actualizar a la versión 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7 o 5.16.8, o a la que solucione el problema. Los usuarios existentes pueden implementar TLS mutuo para mitigar el riesgo en los corredores afectados.

07 May 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-07 09:15

Updated : 2025-07-18 14:50

NVD link : CVE-2025-27533

Mitre link : CVE-2025-27533

CVE.ORG link : CVE-2025-27533

JSON object : View

Products Affected

apache

  • activemq
CWE
CWE-789

Memory Allocation with Excessive Size Value