CVE-2015-5254 Improper Input Validation in Apache ActiveMQ

What is CVE-2015-5254?

CVE-2015-5254 is a critical unsafe deserialization vulnerability in Apache Activemq, published on 8 Jan 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Weakness: CWE-20

Which versions are affected by CVE-2015-5254?

4 open source packages ship an affected version, including org.apache.activemq:activemq-client. It affects 3 products.

Products include Apache Activemq, Fedoraproject Fedora, Redhat Openshift.

How do I fix CVE-2015-5254?

Upgrade org.apache.activemq:activemq-client to a fixed version for your release line: 5.11.3 or 5.12.2.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2015-5254 being exploited?

There is no known exploitation of CVE-2015-5254 in the wild and no public exploit code.

Public exploit code: 5 proofs of concept on GitHub.

Other vulnerabilities in Apache Activemq

• CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data Exploited Critical 10.0
• CVE-2016-3088 Apache ActiveMQ Improper Input Validation Exploited Critical 9.8
• CVE-2026-34197 Apache ActiveMQ Improper Input Validation Exploited High 8.8
• CVE-2020-11998 Remote code execution in Apache ActiveMQ Critical 9.8
• CVE-2013-7285 Command Injection in Xstream Critical 9.8

All Apache Activemq vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2015-5254, DSA-3524-1, GHSA-q9hr-3pg4-3jp4, UBUNTU-CVE-2015-5254.