Activemq Nms Amqp
Monthly
Remote code execution in the ActiveMQ NMS AMQP .NET client affects all releases up to and including 2.3.0 when the client initiates an AMQP session to an attacker-controlled, compromised, or otherwise untrusted broker; that server can return crafted serialized data the client deserializes without bounds, potentially executing arbitrary code on the client host. The primary prerequisite is control or impersonation of the broker endpoint the client connects to, so deployments that only talk to trusted, internally controlled brokers are not realistically exploitable without first compromising that broker or the network path, and the allow/deny-list deserialization restriction added in 2.1.0 is bypassable so enabling it does not guarantee protection. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); EPSS is 2.09% (81st percentile) and the vendor-released fix is version 2.4.0.
Remote code execution in the ActiveMQ NMS AMQP .NET client affects all releases up to and including 2.3.0 when the client initiates an AMQP session to an attacker-controlled, compromised, or otherwise untrusted broker; that server can return crafted serialized data the client deserializes without bounds, potentially executing arbitrary code on the client host. The primary prerequisite is control or impersonation of the broker endpoint the client connects to, so deployments that only talk to trusted, internally controlled brokers are not realistically exploitable without first compromising that broker or the network path, and the allow/deny-list deserialization restriction added in 2.1.0 is bypassable so enabling it does not guarantee protection. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); EPSS is 2.09% (81st percentile) and the vendor-released fix is version 2.4.0.