Severity
High
Analysis Summary
CVE-2025-29953
A deserialization vulnerability exists in Apache ActiveMQ NMS OpenWire Client before version 2.1.1, which can allow remote code execution. The issue occurs when connecting to untrusted servers that can abuse the client's unbounded deserialization capabilities. While version 2.1.0 introduced an allow/denylist feature to restrict deserialization, this feature could still be bypassed. The .NET team has recommended moving away from binary serialization, and the Apache ActiveMQ NMS OpenWire Client project is considering removing this part of their NMS API. Users are strongly advised to upgrade to version 2.1.1 to address this security risk and to plan for future migration away from .NET binary serialization as a security measure.
Impact
- Code Execution
Indicators of Compromise
CVE
CVE-2025-29953
Affected Vendors
Affected Products
- Apache ActiveMQ NMS OpenWire Client - 2.1.1
Remediation
Upgrade to the latest version of Apache ActiveMQ NMS OpenWire Client, available from the Apache Security Advisory.