Skip to content
OpenAdvisories
Medium · 6.9 Public exploit CVE-2025-27533 BIT-activemq-2025-27533EUVD-2025-13714GHSA-whxr-3p84-rf3c

Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

Published May 7, 2025 · Updated Nov 3, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache ActiveMQ Package: activemq Package: activemq Package: org.apache.activemq:activemq-client Package: org.apache.activemq:activemq-openwire-legacy Package: zipkin Package: zipkin-oci-entrypoint Package: zipkin-slim Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.

During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.

Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.

Existing users may implement mutual TLS to mitigate the risk on affected brokers.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache ActiveMQ 6.0.0 – < 6.1.6, 5.18.0 – < 5.18.7, 5.17.0 – < 5.17.7, 5.16.0 – < 5.16.8 6.1.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 activemq 5.17.6+dfsg-2 —
Debian 12 activemq No fix yet —
Debian 11 activemq 5.16.1-1+deb11u2 DLA-4222-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 activemq No fix yet —
Ubuntu 26.04 LTS activemq No fix yet —
Ubuntu 25.10 activemq No fix yet —
Ubuntu 24.04 LTS activemq No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS activemq No fix yet —
Ubuntu Pro 20.04 LTS activemq No fix yet —
Ubuntu Pro 18.04 LTS activemq No fix yet —
Ubuntu Pro 16.04 LTS activemq No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling zipkin +2 3.5.1-r1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.activemq:activemq-client < 5.16.8 5.16.8 GHSA-whxr-3p84-rf3c
Maven org.apache.activemq:activemq-client >= 5.17.0, < 5.17.7 5.17.7 GHSA-whxr-3p84-rf3c
Maven org.apache.activemq:activemq-client >= 5.18.0, < 5.18.7 5.18.7 GHSA-whxr-3p84-rf3c
Maven org.apache.activemq:activemq-client >= 6.0.0, < 6.1.6 6.1.6 GHSA-whxr-3p84-rf3c
Maven org.apache.activemq:activemq-openwire-legacy < 5.16.8 5.16.8 GHSA-whxr-3p84-rf3c
Maven org.apache.activemq:activemq-openwire-legacy >= 5.17.0, < 5.17.7 5.17.7 GHSA-whxr-3p84-rf3c
Maven org.apache.activemq:activemq-openwire-legacy >= 5.18.0, < 5.18.7 5.18.7 GHSA-whxr-3p84-rf3c
Maven org.apache.activemq:activemq-openwire-legacy >= 6.0.0, < 6.1.6 6.1.6 GHSA-whxr-3p84-rf3c

Advisories 11

References