Analysis Summary

CVE-2025-29953

A deserialization vulnerability exists in Apache ActiveMQ NMS OpenWire Client before version 2.1.1, which can allow remote code execution. The issue occurs when connecting to untrusted servers that can abuse the client's unbounded deserialization capabilities. While version 2.1.0 introduced an allow/denylist feature to restrict deserialization, this feature could still be bypassed. The .NET team has recommended moving away from binary serialization, and the Apache ActiveMQ NMS OpenWire Client project is considering removing this part of their NMS API. Users are strongly advised to upgrade to version 2.1.1 to address this security risk and to plan for future migration away from .NET binary serialization as a security measure.

Impact

• Code Execution

Indicators of Compromise

CVE

• CVE-2025-29953

Affected Vendors

Remediation

Upgrade to the latest version of Apache ActiveMQ NMS OpenWire Client, available from the Apache Security Advisory.

Apache Security Advisory