CVE-2025-29953

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client.

This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed.

The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether.

Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Apr 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-299545.9Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service ovCVE-2025-299555.5Improper input validation in Windows Hyper-V allows an unauthorized attacker to deny service locally.CVE-2025-299565.4Buffer over-read in Windows SMB allows an authorized attacker to disclose information over a network.CVE-2025-299576.2Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally.CVE-2025-299586.5Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information ovCVE-2025-299596.5Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information ovCVE-2025-29965.3A vulnerability was found in Tenda FH1202 1.2.0.14(408) and classified as critical. This issue affects some unknown processing of the file /CVE-2025-299606.5Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a networCVE-2025-299616.5Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a networCVE-2025-299628.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.CVE-2025-299638.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.CVE-2025-299648.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
CVE-2025-29953: Critical severity, CVSS 9.8 | Vulnix