MavenPackage

org.apache.activemq:activemq-openwire-legacy

2 known vulnerabilities (1 critical, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

CVE-2025-27533
Affects 5.8.0 to 5.16.7 (5.16.8 is outside it); 5.17.0 to 5.17.6 (5.17.7 is outside it); 5.18.0 to 5.18.6 (5.18.7 is outside it); 6.0.0 to 6.1.5 (6.1.6 is outside it)
CVE-2023-46604
Affects 5.8.0 to 5.15.15 (5.15.16 is outside it); 5.16.0 to 5.16.6 (5.16.7 is outside it); 5.17.0 to 5.17.5 (5.17.6 is outside it); 5.18.0 to 5.18.2 (5.18.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2025-27533Medium 6.9
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Affected: fixed in 5.16.8; from 5.17.0, fixed in 5.17.7; from 5.18.0, fixed in 5.18.7; from 6.0.0, fixed in 6.1.6.
Fixed in 5.16.8 (released Mar 18, 2025, 50 days before disclosure), 5.17.7 (released Mar 14, 2025, 54 days before disclosure), 5.18.7 (released Mar 13, 2025, 55 days before disclosure) and 1 other version.
The latest release, 6.4.0, is not affected.
CVE-2023-46604Critical 10.0 · KEV
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
Affected: from 5.8.0, fixed in 5.15.16; from 5.16.0, fixed in 5.16.7; from 5.17.0, fixed in 5.17.6; from 5.18.0, fixed in 5.18.3.
Fixed in 5.15.16 (released Oct 26, 2023, 1 day before disclosure), 5.16.7 (released Oct 25, 2023, 2 days before disclosure), 5.17.6 (released Oct 25, 2023, 2 days before disclosure) and 1 other version.
The latest release, 6.4.0, is not affected.