Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• apache activemqbefore 5.15.16
• apache activemq5.16.0 and later · before 5.16.7
• apache activemq5.17.0 and later · before 5.17.6
• apache activemq5.18.0 and later · before 5.18.3
• apache activemq legacy openwire modulebefore 5.15.16
• apache activemq legacy openwire module5.16.0 and later · before 5.16.7
• apache activemq legacy openwire module5.17.0 and later · before 5.17.6
• apache activemq legacy openwire module5.18.0 and later · before 5.18.3
• debian debian linux10.0
• debian debian linux11.0
• netapp e-series santricity unified managerall versions
• netapp e-series santricity web services proxyall versions
• netapp santricity storage pluginall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (apache). Independent of NVD's CPE analysis and usually ahead of it.

• Apache Software Foundation Apache ActiveMQ

  • 5.18.0 and later · before 5.18.3affected · semver
  • 5.17.0 and later · before 5.17.6affected · semver
  • 5.16.0 and later · before 5.16.7affected · semver
  • before 5.15.16affected · semver

• Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module

  • 5.18.0 and later · before 5.18.3affected · semver
  • 5.17.0 and later · before 5.17.6affected · semver
  • 5.16.0 and later · before 5.16.7affected · semver
  • 5.8.0 and later · before 5.15.16affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2016-3088The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTKEV
  99Now
• CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansKEV
  70This week
• CVE-2022-41678Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE
  61This week
• CVE-2020-11998A regression has been introduced in the commit preventing JMX re-bind.
  54Plan
• CVE-2015-5254Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execu
  50Plan
• CVE-2020-13947An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp
  48Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Data received over the network is deserialized into the language’s native object format without verifying its source. Code paths inside the object can be triggered during deserialization.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1payload = sock.recv(65536)2job = pickle.loads(payload)

1payload = sock.recv(65536)2if not hmac.compare_digest(sign(payload), header_sig):3    raise PermissionError("invalid signature")4job = JobSchema.validate(json.loads(payload))

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.