Advisory details:
github_osv / GHSA-whxr-3p84-rf3c
| Advisory ID | github_osv/GHSA-whxr-3p84-rf3c |
| Aliases |
CVE-2025-27533
|
| Summary | Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 6.8 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 7.5 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json |
| cvssv4 | 6.9 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json |
| generic_textual | MODERATE |
| Data source | Exploit-DB |
|---|---|
| Date added | May 9, 2025 |
| Description | Apache ActiveMQ 6.1.6 - Denial of Service (DOS) |
| Ransomware campaign use | Unknown |
| Source publication date | May 9, 2025 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | May 9, 2025 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-07T13:59:20Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/27xxx/CVE-2025-27533.json
Source Advisory: vulnrichment/CVE-2025-27533
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]