What is CVE-2025-54539?

CVE-2025-54539 is a critical-severity vulnerability in Apache Activemq Nms Amqp, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-10-16.

How severe is CVE-2025-54539?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Deserialization in Apache Activemq Nms Amqp

CVE-2025-54539

A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic present in the client to craft responses that may lead to arbitrary code execution on the client side. Although version 2.1.0 introduced a mechanism to restrict deserialization via allow/deny lists, the protection was found to be bypassable under certain conditions. In line with Microsoft’s deprecation of binary serialization in .NET 9, the project is evaluating the removal of .NET binary serialization support from the NMS API entirely in future releases. Mitigation and Recommendations: Users are strongly encouraged to upgrade to version 2.4.0 or later, which resolves the issue. Additionally, projects depending on NMS-AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy.

Vulnerability class: Insecure Deserialization

Published 2025-10-16 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.021 (80.8th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 80.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: +0.000

Affected products

Apache Activemq Nms Amqp
Apache Software Foundation Activemq Nms Amqp Client — versions 0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

lists.apache.org/thread/9k684j07ljrshy3hxwhj5m0xjmkz1g2n (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2025-54539?: CVE-2025-54539 is a critical-severity vulnerability in Apache Activemq Nms Amqp, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-10-16.
How severe is CVE-2025-54539?: Critical severity. CVSS v3 base score is 9.8 out of 10.