Description
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | activemq | 5.13.2+dfsg-1 | — |
| Debian 12 | activemq | 5.13.2+dfsg-1 | — |
| Debian 8 | activemq | 5.6.0+dfsg1-4+deb8u2 | DSA-3524-1 |
| Debian 7 | activemq | 5.6.0+dfsg-1+deb7u2 | DSA-3524-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | activemq | 5.6.0+dfsg-1+deb7u2build0.14.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 2 | activemq +1 | 5.9.0-6.redhat.611454.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | jenkins | 1.625.3-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | openshift-enterprise-release +4 | 2.2.9-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | openshift-origin-broker-util | 1.37.5.3-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-cron | 1.25.2.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-haproxy | 1.31.5.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-mysql | 1.31.2.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-php | 1.35.3.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-python | 1.34.2.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | openshift-origin-msg-node-mcollective | 1.30.2.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | openshift-origin-node-proxy | 1.26.2.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | openshift-origin-node-util | 1.38.6.2-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | php +7 | 5.3.3-46.el6_7.1 | RHSA-2016:0489 |
| Red Hat OpenShift 2 | rhc | 1.38.6.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-common | 1.29.5.2-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-console | 1.35.5.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-controller | 1.38.5.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-frontend-apache-vhost | 0.13.2.1-1.el6op | RHSA-2016:0489 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-node | 1.38.5.3-1.el6op | RHSA-2016:0489 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
Catherines77/ActiveMQ-EXPtools ★ 86 · Apr 20, 2026
Apache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2023-46604，CVE-2024-32114，CVE-2026-34197，CVE-2026-40466， CVE-2026-42588)
-
jas502n/CVE-2015-5254 ★ 15 · Aug 30, 2019
ActiveMQ Deserialization RCE
-
Ma1Dong/ActiveMQ_CVE-2015-5254 ★ 2 · Aug 3, 2020
ActiveMQ_CVE-2015-5254
-
radsih/activemq-cve-lab ★ 0 · Aug 31, 2026
ActiveMQ CVE-2015-5254 模拟靶场 - 用于 CVE 测试评测和 SCA 扫描演示
-
guigui237/Exploitation-de-la-vuln-rabilit-CVE-2015-5254- ★ 0 · Nov 5, 2024
La vulnérabilité CVE-2015-5254 est une faille de sécurité dans Apache ActiveMQ, un serveur de messages open source largement utilisé pour la communication entre applications. Cette vulnérabilité touc…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:activemq-client | >= 5.0.0, < 5.11.3 | 5.11.3 | GHSA-q9hr-3pg4-3jp4 |
| Maven | org.apache.activemq:activemq-client | >= 5.12.0, < 5.12.2 | 5.12.2 | GHSA-q9hr-3pg4-3jp4 |
Advisories 2
- RHSA-2016:0489 Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.9 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- DSA-3524-1 activemq - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-3524 vendor-advisory
- RHSA-2016:2035 vendor-advisory
- FEDORA-2015-7ca4368b0c vendor-advisory
- [oss-security] 20151208 [ANNOUNCE] CVE-2015-5254 - Unsafe deserialization in ActiveMQ mailing-list
- RHSA-2016:0489 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
- FEDORA-2015-eefc5a6762 vendor-advisory
- RHSA-2016:2036 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://issues.apache.org/jira/browse/AMQ-6013
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ mailing-list