What is CVE-2025-54539?

CVE-2025-54539 is a critical-severity vulnerability in Apache Activemq_nms_amqp, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-10-16.

How severe is CVE-2025-54539?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Deserialization in Apache Activemq_nms_amqp

CVE-2025-54539

A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP server…

Vulnerability class: Insecure Deserialization

EPSS: 0.020 (78.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Activemq_nms_amqp
Apache Software Foundation Activemq Nms Amqp Client — versions 0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2025-54539?: CVE-2025-54539 is a critical-severity vulnerability in Apache Activemq_nms_amqp, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-10-16.
How severe is CVE-2025-54539?: Critical severity. CVSS v3 base score is 9.8 out of 10.