CVE-2025-29953

Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed. The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether. Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future.

• CWE-502
• CWE-502

• https://lists.apache.org/thread/vc1sj9y3056d3kkhcvrs9fyw5w8kpmlxMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2025/04/18/3Mailing List, Third Party Advisory

Published

Apr 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29948Improper access control in AMD Secure Encrypted Virtualizati…5.9
• CVE-2025-29949Insufficient input parameter sanitization in AMD Secure Proc…4.8
• CVE-2025-2995A vulnerability has been found in Tenda FH1202 1.2.0.14(408)…6.9
• CVE-2025-29950Improper input validation in system management mode (SMM) co…7.1
• CVE-2025-29951A buffer overflow in the AMD Secure Processor (ASP) bootload…7.3
• CVE-2025-29952Improper Initialization within the AMD Secure Encrypted Virt…5.9
• CVE-2025-29954Uncontrolled resource consumption in Windows LDAP - Lightwei…5.9
• CVE-2025-29955Improper input validation in Windows Hyper-V allows an unaut…5.5
• CVE-2025-29956Buffer over-read in Windows SMB allows an authorized attacke…5.4
• CVE-2025-29957Uncontrolled resource consumption in Windows Deployment Serv…6.2
• CVE-2025-29958Use of uninitialized resource in Windows Routing and Remote …6.5
• CVE-2025-29959Use of uninitialized resource in Windows Routing and Remote …6.5