# org.apache.activemq:activemq-openwire-legacy (Maven) vulnerabilities 2 known vulnerabilities (1 critical, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 6.4.0 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 6.4.0 (Oct 22, 2026), the latest release - Dependents: 68 - Releases: 109 since 5.8.0 (Feb 6, 2013) - Registry: https://central.sonatype.com/artifact/org.apache.activemq/activemq-openwire-legacy - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-27533: 5.8.0 to 5.16.7 (5.16.8 is outside it); 5.17.0 to 5.17.6 (5.17.7 is outside it); 5.18.0 to 5.18.6 (5.18.7 is outside it); 6.0.0 to 6.1.5 (6.1.6 is outside it) - CVE-2023-46604: 5.8.0 to 5.15.15 (5.15.16 is outside it); 5.16.0 to 5.16.6 (5.16.7 is outside it); 5.17.0 to 5.17.5 (5.17.6 is outside it); 5.18.0 to 5.18.2 (5.18.3 is outside it) ## Advisories (2) ### [CVE-2025-27533](https://cve.now/CVE-2025-27533): Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation - Severity: Medium 6.9 - Published: May 7, 2025 - Affected: fixed in 5.16.8; from 5.17.0, fixed in 5.17.7; from 5.18.0, fixed in 5.18.7; from 6.0.0, fixed in 6.1.6. - Fixed in 5.16.8 (released Mar 18, 2025, 50 days before disclosure), 5.17.7 (released Mar 14, 2025, 54 days before disclosure), 5.18.7 (released Mar 13, 2025, 55 days before disclosure) and 1 other version. - The latest release, 6.4.0, is not affected. ### [CVE-2023-46604](https://cve.now/CVE-2023-46604): Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack - Severity: Critical 10.0 ยท KEV - Published: Oct 27, 2023 - Affected: from 5.8.0, fixed in 5.15.16; from 5.16.0, fixed in 5.16.7; from 5.17.0, fixed in 5.17.6; from 5.18.0, fixed in 5.18.3. - Fixed in 5.15.16 (released Oct 26, 2023, 1 day before disclosure), 5.16.7 (released Oct 25, 2023, 2 days before disclosure), 5.17.6 (released Oct 25, 2023, 2 days before disclosure) and 1 other version. - The latest release, 6.4.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.activemq:activemq-openwire-legacy Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.